An agent can understand a task and still attempt an action you did not authorize. The useful place to decide whether that action may run is the dispatcher that actually performs it. A prompt can explain the rules; a dispatcher can enforce them before a connected tool body starts.
Source: [Dev.to](https://dev.to/seaneboneslang/put-a-permission-gate-between-your-agent-and-its-tools-p9a)