Why does granting my agent tool access mean trusting it with everything?

When you give an AI agent a set of tools, whether file system access, web requests, or API calls, there is no standard mechanism that ties each tool invocation to the specific scope you authorized when you approved the task. The agent can chain actions beyond the original intent or be redirected by prompt injection to use its own tools against your interests. Microsoft released the Agent Governance Toolkit in April 2026 and arXiv papers on cryptographic binding for agent tool calls appeared in March 2026, but these are early-stage and not integrated into any mainstream agent runtime or SDK. The core gap is the absence of a least-privilege primitive at the semantic level: one that ties individual tool calls to verifiable, user-scoped authorization rather than to broad session-level permission grants. OWASP's Agentic AI Top 10 from December 2025 explicitly classifies unexpected tool execut