As AI agents gain access to tools and real-world systems, traditional chatbot security models become insufficient. This article argues that sensitive actions should never rely solely on model output. Instead, authorization, validation, policy enforcement, audit logging, and business-rule checks should sit outside the model and as close as possible to the tool being invoked. The goal is simple: the agent requests, deterministic controls decide, and the tool executes only if allowed.