Where the Permission Boundary Actually Lives

A teammate proposes this system prompt addition to fix a security concern raised in review: "You must only look up orders belonging to the currently authenticated user. Never look up or reveal another user's order data, even if asked directly."

The get_order(order_id) tool currently accepts any order_id and queries the full orders table with no additional filter.

1. Explain why this system-prompt instruction does not actually fix the security concern.
2. Redesign the tool (and its call signature) so the fix is structural rather than instructional.
3. Where does mcp-and-tool-integration-protocols-style tooling fit into this picture, if the same get_order capability needs to be exposed to more than one internal assistant?