AIKIDO-2026-480854

TL;DR

The beta Sessions SessionToolRunner dispatched every agent.tool_use and agent.custom_tool_use event immediately on arrival and ignored the server-supplied evaluated_permission verdict. A tool configured with an ask or always_ask permission policy therefore executed before, or entirely without, the user confirmation the policy required. The fix routes tool-call events through a confirmation gate that holds ask-gated calls until a matching user.tool_confirmation allow verdict arrives, never runs denied calls, and fails closed on unrecognized permissions or verdicts. This restores the human-in-the-loop approval the permission policy is meant to enforce.