An agent holds a valid token, it calls an approved tool. Every individual step in the chain passes authorization, because every individual step was designed to pass. The chain as a whole does something nobody sanctioned, and by the time the alert lands in a queue, the agent finished nineteen minutes ago.