Putting the security decision in the prompt is still the common agent footgun. Permissions, redaction, and approval gates have to live in deterministic code outside the model, especially when MCP servers hold real OAuth. Tool output is input too: if the tool can inject, your egress allowlist just became the confused deputy.