Pick the context for a one-service auth change

You need to change the auth middleware in one service of a 600,000-line monorepo. It must start rejecting tokens issued before the user's last password change.

One engineer wants to load the whole repo into the agent's context on every request, "so it knows everything". Another wants to build a retrieval system first, so the agent can pull in relevant files on demand. The change is due this week.

What context do you give the agent for this change, and what do you say to each engineer?