Consider these scenarios
An MCP server quietly returning extra tool descriptionsPrompt injection through a calendar inviteAn Agent invokes a tool that the principal should not have access toCost overrunsIt isn't the model that failed. It isn't the tool that failed. What failed is the trust boundary, the trust between two components wi...