Agents execute tool calls. Most of them are fine. Some of them delete staging databases, send emails to the wrong distribution list, or git push --force onto a branch someone was reviewing. The gap between "the model decided" and "the tool ran" is wh...