That gap between the Cedar policy allowing 2 tools and semantic search still returning all 6 with full schemas is a real hole, because the model is now reasoning about capabilities it can never call. Even when the gateway blocks the invoke, you have paid for the tokens and widened the surface for a confused-deputy prompt. I would scope the tool-search index per identity, but I am curious whether AgentCore makes you choose between one shared index and per-user latency. How did you end up handling it?