A team runs a code-review agent with the Claude Agent SDK in a CI job, using permission_mode="bypassPermissions" so it never stalls waiting for a person. Its only job is to read the checked-out code and report findings; it must never modify files or run shell commands. An engineer proposes setting allowed_tools=["Read", "Grep"] and nothing else. A reviewer says this does not enforce the requirement. What is the best way to scope the agent to its job?