Sometime in the last year, "the agent will just edit the file" stopped being hypothetical and became a normal workflow. Point an agent at a config, a document, or a blob of state, and it reads, edits, and writes it back, with no UI in between.
That's useful. It's also a trust problem most formats were never built to handle.
Most systems treat "let an agent gain new tools while it runs" and "stop an agent from doing damage" as two problems with two solutions: a tool registry plus an approval workflow, or a plugin marketplace plus a permission system added afterward.
In Stof, they're the same mechanism. A document can only reach what it has been given, so a tool that arrives at runtime is limited the same way everything else in the document already is. Not because a permission check ran, but because there's nothing else there to reach.