Agent tool authorization: bind sensitive approvals to the exact operation

Give each task the smallest tool set and resource scope it requires. A read-only research task should not inherit deployment or account-administration rights.

For operations requiring approval under your policy, store approval outside model-controlled context. Bind it to the authenticated actor, tool, target resource, normalized arguments, and expiration. Validate and consume single-use approval atomically immediately before execution. Changed parameters need a newly matching authorization.

Test with a sandbox executor: change the target after approval, replay the same request, submit two concurrent copies, and call an unknown tool. Assert that disallowed effects never occur, including when policy lookup fails. Also test a permitted operation so fail-closed behavior does not silently disable legitimate work.

Evidence: source-based implementation pattern; these concurrency and authorization cases have not been executed here. A schema check alone cannot establish authorization correctness.