The part about permissions being enforced outside the prompt is key. If the agent can't call the tool, there's nothing to argue about.