The outcome is an AI agent that can perform useful work without inheriting blanket authority, quietly repeating an ambiguous side effect, or leaving investigators with only a chat transcript. A tool called `send_invoice` or `rotate_key` is not a security boundary. The real decision includes the actor, purpose, target, parameters, materiality, time window, approval, and recovery path.

This technical session builds that boundary from first principles. We begin with a threat model for tool-using agents: prompt injection, confused-deputy actions, delegated sub-agents, retries after timeouts, identity drift, and escalation from one permitted action to a dangerous batch. A live demonstration then converts each proposed tool call into a canonical effect envelope, assigns an action tier, enforces short-lived authority and segregation of duties, makes irreversible effects idempotent, preserves a hash-chained decision receipt, and stops for a human when policy cannot decide safely.

The patterns draw on hands-on deployment of agents with Azure AI Foundry, custom sandboxing, and MCP in .NET, together with the public CloseGate and Regulus reference systems. Those systems demonstrate policy, approval, audit, and recovery patterns; they are not presented as certifications or universal security guarantees. The demonstration uses a mock high-impact action and no production credentials.

Intermediate security practitioners, architects, IAM and GRC professionals, and application-security engineers will leave able to:

1. Model an agent permission as an exact effect rather than a broad tool name.
2. Place human approval where identity, purpose, materiality, or irreversibility demands it.
3. Preserve an evidence record that distinguishes proposal, authorisation, execution, retry, and recovery.
4. Test prompt injection, delegation, replay, and batch-escalation paths before granting an agent real authority.