Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. Immediately above the check sits a narrower branch that restores a tool-use message the agent stored before an interrupt, rather than taking whatever sits in the latest message. Authorize at execution time: Bind each tool invocation to the exact model event, tool name, arguments, session, and authorization state that produced it. Bind each tool invocation to the exact model event, tool name, arguments, session, and authorization state that produced it. There is no probabilistic model to fool and no stronger model that resists it, because the model never gets a turn.