Every action was permitted. The sequence was not.
Permissions products answer "may this caller do this thing". That is the easy level, and where most of them stop.
Rules only, so changing one needs no release.
Who is calling
The user, the agent, or both. Either one alone, or one that your system states and one that proves who it is. It matters far more on a tool call than on a model call, because a tool call takes a real action in a real system.
Three levels of what they may do
| Level | Question | Who else does this |
|---|---|---|
| Roles and grants | may this identity act at all | everyone |
| Endpoint level | may it call this specific tool | the good ones |
| Policy level | is this call, with these arguments, in this sequence, permitted | the level we are built for |
Read a customer record: allowed. Look up an external address: allowed. Send a document there: allowed. Do all three in sequence on one customer: that is an exfiltration, and no per-call permission check will ever see it, because every call passed.
MITRE ATLAS catalogs this as AML.T0086, Exfiltration via AI Agent Tool Invocation. Your security team can open that page and read the technique.
Catching it needs state across calls and a rule that can test a sequence. That is the same machinery as business rules, pointed at permissions instead of money.
And when the agent is not yours
Everything above assumes you can look the caller up. When the agent belongs to another company, you cannot. For agents crossing between companies on chain, the answer taking shape is a public standard rather than any one company's registry: ERC-8004.