Most agent security still stops at the tool call.

A permission check runs once, the action executes, and nobody asks what happened three steps earlier. That gap is where excessive agency lives. An agent that is allowed to read a file is not the same