What permissions should an AI agent be allowed to decide for itself?

A model's belief that an action is allowed cannot be the mechanism that authorizes the action. In an agent deployment, the model may decide which tool to call, how to sequence work, and what it thinks the user meant. But that reasoning should not be able to create new authority. A useful separation is: Reasoning proposes. Authority permits. Enforcement constrains. Evidence proves what happened. The permission should originate outside the acting model: explicit user delegation, scoped credentials or capabilities, policy, an approval gate, a sandbox, or an independently enforced constraint. The practical wrinkle is that every real workflow has ambiguity. A user may say “clean up my inbox” without specifying what counts as deletion. A policy engine may need semantic interpretation. A second LLM may help classify risk but does not become a hard security boundary just by being separate. For people who have deployed agents with tools: where do you draw the line? Which decisions can the model safely make on its own, and which must be checked outside it? I am especially interested in approval systems, tool wrappers, capability scopes, prompt-injection failures, confused-deputy problems, and cases where the clean separation breaks down. Please red-team the principle rather than simply agreeing with it.