Yethikrishna R

Thanks, Brian. That's a useful test: one vague tool description can change which action an agent thinks is allowed. A clear description helps, but I'd still want the identity grant to stop a read or send outside the task's scope. What kind of tool wording made the biggest difference for you?

Thanks, Kartik. I'd put the deny at the identity layer: if the action's purpose and the identity grant don't line up, the graph's candidate context shouldn't make the read or send permissible. The runtime should record that decision so the user can see why it stopped. Would you test that as an explicit cross-layer case in the harness?