An agent with a delete tool and a loose prompt can read “clean up my old entries” as permission. Nothing malfunctions. The message allows that reading and the tool allows the action. What's missing is a rule about when the tool may run. This post continues my series on building agents. The previous one covered MCP . What autonomy is An agent's autonomy is how much it may do on its own before a human has to approve, review or step in. It is a policy your code enforces, not a t...