Your agent asks. Something answers before it acts.

The shape of the problem

Agents do not misuse tools because they are malicious. They misuse them because the tool was available and the task looked close enough.

A scope token and a JSON schema are not an authorization model. What is missing is a decision at the moment of the call: who is asking, on whose behalf, for what resource, under which policy revision — and a record that survives the incident review.

The runtime

1. Wrap the toolOne decorator or one HTTP hop. The tool keeps its schema; Seraphbyte intercepts the call.
2. EvaluatePolicy is code: subject, task scope, resource pattern, amount, time window. Deny wins over allow, always.
3. RecordEvery decision becomes a signed, replayable record: inputs hashed, rule matched, revision, latency.

Decision contract

A deny is a first-class response, not an exception. Callers get a reason code they can show a human, and a decision id they can hand to an auditor.

# ask before acting
curl https://api.seraphbyte.tech/v1/authorize \
  -H "authorization: Bearer $SB_KEY" \
  -d '{
    "subject": "agent://billing-refund",
    "task":    "refund-under-50",
    "action":  "stripe.refund.create",
    "resource":{"charge":"ch_3Pq…","amount":42.00}
  }'

200 { "decision": "allow",
      "rule": "refund-under-50#v7",
      "decision_id": "dc_9f12a7", "ttl_s": 30 }

403 { "decision": "deny",
      "reason": "amount_exceeds_task_scope",
      "decision_id": "dc_9f12a8" }