Tool-Invocation Authorization Integrity Check

Your agent invoked wire_transfer — but was it ever granted that tool?

The inverse of the least-privilege check no other surface grades: an agent that invokes a tool that was never granted to it — a hallucinated/phantom tool name (delete_all_records, wire_transfer) the model is confident it has, or a real but off-allowlist privileged tool (scope-escape / excessive agency). Capability scanning tracks granted-but-unused tools; argument integrity grades a granted tool's structured args; supply-chain grades a registered tool's drift. None grade whether the tool the agent invokes was ever in its toolset at all. AgentSmack builds the authoritative granted-tool set from your tool.granted events and checks every tool.invoked for set membership under default-deny on unknowns — a phantom destructive tool or a real off-allowlist privileged tool fires a hard blocker. Ground-truth-first: an invoked tool that IS in the granted set (with its required approval) scores a clean 100 — the score grades unauthorized invocation, not tool use itself. An invocation with no grant declared at all is honest-empty insufficient_signal, never a fabricated pass. Raw tool names and args are never stored. Load a sample to watch the granted → invoked → action lineage light up with no live infra.