The agent checked who you are, then never checked what you asked for

Your session auth is probably fine. The object your agent fetched on your behalf is the part nobody guarded.

Almost every agent gets built with the session boundary correct. You log in, the request carries your identity, and the framework enforces it. Then the agent is given a tool that takes an identifier, a conversation, a ticket, an order, a record, and the tool goes and gets it.

The identifier is where it fails. The tool trusts that whatever the model passed it was something the caller was entitled to, because the caller was authenticated. Authenticated and authorized get collapsed into one check, and the second one quietly never happens.

What makes it hard to see in review is that the model is doing exactly what it was asked. There is no injection, no jailbreak, no clever prompt. A user asks about their order, the agent asks about a different order, and the backend answers because the session was valid.

Standard defenses miss it because they are watching the language. A guardrail scoring the prompt for hostility sees a polite customer question. A WAF sees an authenticated API call in the normal shape. The failure is one layer under the thing being monitored.

The check to run: for every tool your agent can call, ask whether the ownership of the argument is verified at the point the data is read, not at the point the user logged in. If the answer involves the word "should", it is not verified.