Admitting an MCP server once and treating that as forever tool permission is how agent hosts quietly accumulate god-mode. Session-scoped tool grants with short lifetimes keep the connection handshake separate from what the model can invoke this turn. Deny-by-default at admission also saves the weird tool calls nobody asked for. Are your allowlists per project, per user, or still a shared JSON file copied from a README?