Agent incidents rarely look like a movie villain. They look like a helpful assistant combining two permissions you never meant to combine: a note-reader that can summarize a folder, plus a messenger that can post to a webhook, plus one poisoned paragraph in a document that says where the notes should go. After writing about prompt changes as migrations, I started treating tool permission the same way: as a reviewed contract, not a vibe in the system prompt. The pattern I keep reaching for is ...