Your agent has access to delete_user()?

Tool access is easy to check. Authorization gets harder. Suppose an agent has access to delete_user(). That doesn't tell you which users it can delete, or when, or under what conditions, or whether the action requires approval. A production authorization decision might need: agent identity, tool identity, target resource and environment, current policy, execution context, budget, approval state. Then the gate evaluates the actual action. That's a very different architecture from putting the agent behind a static list of allowed tools. The tool list answers what the agent can reach. The runtime decision answers what it can actually execute right now. Non-deterministic agents in production impact finances and can make decisions that affect the stability and reputation of the company and the product. Auditors and stakeholders do not care how your agent arrived at the decision to overcapitalize the NFT market by 200% at the end of 2026. When analyzing your agent's tools, do you check whether it should execute a given tool right now - considering the current parameters, previous session states, and budget limits - as well as whether it has entered an infinite loop and how the current LLM call aligns with policies?