Agent Tool Authorization Lab Tests Guardrails

Schema-valid tool calls can still target the wrong invoice, tenant, recipient, or amount, so authorization must be enforced outside the model.

• –Server-side ownership checks prevent forged tenant or invoice arguments.
• –Exact approval binding blocks modified recipients, amounts, or payloads.
• –No-execute collection provides useful telemetry without adding production side effects.
• –Deterministic fixtures demonstrate control behavior, but do not measure model accuracy or cover replay, expiry, or race conditions.