Ask for a code change on the test repo. The orchestrator hands off to the code agent, which can only reach its one tool (enforced by agentgateway). show enforcement matrix