Notes on enforcing policy at the tool call — what I build, what I measure, and what I get wrong. Written for people running agents in production.
A tool definition is an answer, not an artifact — and the protocol has a blessed way for a server to change its answer after you approved it. What that opens, what closes it, and where every defence I know of, mine included, gets thin.