Thanks Kartik — our design principle is that the consequential authority boundary should sit outside the agent.

The agent may reason about and request an action, but it should not be able to authorize itself. For consequential operations, we prefer deterministic policy enforcement, narrowly scoped credentials/capabilities, and explicit approval gates at the tool or execution boundary.

The prompt can describe intended behavior, but it should never be the security boundary.

That separation becomes especially important with MCP and other externally supplied tool surfaces, where tool capability and execution authority must remain independently constrained.