Why can each tool my agent calls be authorized while their sequence is not?

AI agents execute tool calls that each pass normal permission checks in isolation. But a session-level sequence of individually permitted calls can compose into a capability no one approved: read an environment file, search for credential patterns in it, then POST the result to an external endpoint. Traditional authorization operates at the single-call boundary and has no model of what a sequence enables. The Cline incident in February 2026 demonstrated this concretely: a malicious GitHub issue chained individually valid reads and writes into a package install that reached 4,000 developer machines. Intent-governed authorization at the sequence level does not exist as a production primitive today.