Cached permissions make agents confidently wrong, and the fix is one call at session start

A revoked permission and a broken model produce the same log line. The dev.to writeup makes the mechanism plain: when authority is resolved fresh on every call from current membership, roles and permissions, the answer to "can I do this?" can be yes on Monday and no on Tuesday with nothing about the token having changed ^[5][6]. The token still authenticates, because its job is to say which named connection is talking, not to carry the caller's authority ^[4]. So the agent looks healthy, the prompt is the one shipped last week, and the two components a team will spend a day reading are the two that did not change ^[3].

The third symptom in the author's list is the expensive one: a mutation that reports success and silently did nothing ^[2]. A failed call at least raises its hand ^[7]. A false success does not, and it propagates to whoever reads the record later.

The catalog half has the same shape. Any actively developed tool server adds tools, renames arguments, tightens validation and deprecates things ^[9]. The live tools/list response is the source of truth; a catalog copied from documentation, a blog post or a previous session's transcript is not ^[10]. That failure is quieter still, because a model will happily improvise a plausible call against a tool that no longer accepts the argument it remembers ^[11].

Set the price against the exposure. One whoami at session start, against, in the account given, roughly a week of accumulated staleness before anything visibly breaks ^[1]. Two of the five prescribed steps deal with state imported from before the session; the other three are in-session hygiene ^[2]. Page with cursors rather than reading the first page and reporting a total, which is a confident number that is wrong ^[13]. Fetch the complete authorized record and carry its item revisions into the mutation, which is what makes concurrent edits safe instead of last-write-wins ^[14]. Give each intended change a fresh operation id, and reuse one only when you are deliberately retrying that same change, which is the line between a retry and a duplicate ^[15].

The design point underneath is that refusal is the feature ^[16]. An agent free to write any field produces records that are structurally valid and semantically nonsense, such as a task marked delivered with no evidence, or a review verdict with no reviewer ^[17].

On evidence: this is one practitioner's account of three unnamed teams ^[1], and the concrete server behaviour cited is Wagglet's documentation of its own MCP server, where team-level access is off by default and disabling it later rejects every connection request immediately without deleting the connections ^[8]. That is a vendor describing its own design. The mechanism travels anyway, because it belongs to per-call authority resolution rather than to any one server ^[5].