Capability Gating Is Not Authorization

Agent frameworks ship capability gating (which tools are exposed, schema validity) but no fail-closed per-call authorization of argument values, so well-typed unauthorized calls pass; ScopeGate's deterministic PDP/PEP re-authorizes each call against out-of-band policy (0 bypasses, 0 false-denies), replicated by NetInjectBench — and cheaper deployment-tier models attempt unauthorized calls ~3.2× more.