There is a failure I have now watched three separate teams hit, and it always looks like a bug in the agent.
An agent connects to a tool server, does useful work for a week, and then one day starts producing confidently wrong actions. It calls a tool that no longer exists. It tries to transition something it is not allowed to transition. It reports success on a mutation that silently did nothing. Everyone goes looking for the regression in the model, or in the prompt, and the actual cause is that the agent was working from a catalog of tools and permissions it had cached at some point in the past.
The fix is one boring call at the start of every session, and it is worth understanding why it is not optional.
A token is a connection, not a role
Here is the thing people get wrong about tokens on a permissioned tool server. The token identifies which named connection is talking. It does not carry the caller's authority.
