The deeper problem is that an agent can compose individually-permitted actions into an outcome no single permission was meant to authorise — the confused deputy problem, but with natural-language ambiguity layered on top. Most current guardrails check intent at invocation time; almost none audit the cumulative effect of a chain of calls. Until we treat agent sessions as auditable transactions rather than sequences of independent tool uses, 'but you said I could' will keep being technically correct.