You define a billing-dispute subagent using AgentDefinition. It must call process_refund but must never call escalate_to_human. What is the correct way to configure this tool restriction?

1. ASet allowed_tools=['process_refund', 'escalate_to_human'] and rely on the model to choose correctly.
2. BSet tools=['process_refund'] in the AgentDefinition so the subagent inherits only that tool.
3. CAdd a system prompt instruction telling the subagent not to call escalate_to_human.
4. DSet disallowed_tools=['escalate_to_human'] on the coordinator's ClaudeAgentOptions.