Bind, Don't Forbid; Prevent, Don't Detect: The Action-Open and Poisoned-Memory Residuals

Two-question synthesis closing the remaining agent-security #oq/now pair, both instances of the detection-lost-structure-won arc. (1) Forbidding action-open delegation is the wrong control class: it is a discipline prescription aimed at exactly the party least equipped to comply (non-expert users are who under-specifies), i.e. friction — and it sacrifices the delegation value that makes agents useful. Binding achieves the security goal structurally: under-specification hands action-constraining defenses their best case (no named action → conservative trajectory → injected writes blocked regardless of phrasing), so the dangerous configuration is not action-open-plus-user but action-open-plus-filters-only. The ordered prescription: bind by default; when binding starves a genuinely open task, have the *system elicit* specification (clarification-before-commit — the same move unknown-elicitation prescribes on quality grounds, so security and quality co-fund one discipline); and route the safety-critical remainder through per-action authorization (the one channel measured at 100% on protected actions). (2) Nothing catches semantically-poisoned-but-cryptographically-intact memory — provably: the laundering separation theorem shows no content- or lineage-based detector is sound against it. The question's premise (catch it) is retired and replaced by prevention by construction: bind authority-to-act to origin at write time, non-malleably, so the laundered item stays act=none however benign it reads (0% attack-success across 8 models at full utility). Detection's residual role is forensics, not defense