Allowed is not verified

IAM answers who. OAuth answers with which credentials. A policy gate answers may this tool be called.

None of those questions is did the exact thing a human approved actually happen, once, in the real world.

That gap is where agent systems will leak money, mail, and rows.

A retry loop does not need to be malicious. A timeout after a successful transfer is enough. A human clicking approve on amount A, then an agent swapping recipient B, is enough. A row that changed between approval and execution is enough.

This is the TOCTOU problem with a language model in the middle.

KarmaSakshi Protocol exists for that narrower job:

1. Resolve the action into one canonical Effect Manifest.
2. Seal it.
3. Bind authorization to that hash, not to a tool name.
4. Revalidate preconditions at commit time.
5. Execute with exactly-once reservation semantics.
6. Independently observe the system of record.
7. Issue an Action Passport that re-verifies the chain.

The agent never holds the signing key. The engine is the only component that may call commit(). Adapters do not authorize. Compensation is honest about being best-effort.

If your safety story ends at "the tool was allowlisted," you have a permission layer. You do not have a proof.