Raised when a tool confirmation does not bind to the action it claims to
approve — the approval and the action about to run are not the same thing.
The framework fails closed on this: a mismatch aborts the invocation rather
than running an action no human agreed to. It is worth alerting on, so the
message names the reason and the call, and deliberately carries no argument
values — a rejected payload is attacker-controlled and does not belong in
logs.
Raised when a tool confirmation does not bind to the action it claims to approve — the approval and the action about to run are not the same thing.
The framework fails closed on this: a mismatch aborts the invocation rather than running an action no human agreed to. It is worth alerting on, so the message names the reason and the call, and deliberately carries no argument values — a rejected payload is attacker-controlled and does not belong in logs.