Not today, and you’re right that it should be its own line. The event we emit carries the decision and the determining policy IDs; whether the tool was on the menu we sent that session isn’t a field. Cedar can’t supply it either: it sees entities, not what the client was shown.

The fix is gateway-side. When it answers tools/list for an on-behalf-of token it records the filtered set (and bumps a version on list_changed). At call time it compares the tool name against that set and adds advertised: false to the event. That becomes an alert distinct from any forbid ID.

It also catches something the named-forbid alert misses. In the Bob replay in Part 2 (same tenant, no write grant) the deny comes back with “no policies applied”, so there’s no ID to alert on. An unadvertised-tool flag still fires there. The one caveat: a name the agent was never shown can also come from a stale name or a hallucination, so it’s a strong injection signal, not proof. Thanks, this goes into the production write-up.