2 min lesson
When Auto-review was mistaken for authorization
Stop an overbroad tool, inspect its calls and rebuild the permission check inside execute.
Step 1 of 3
The refund callback accepted any order ID because the team expected Auto-review to ask a person.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
diagram: compare
Check the runtime, argument shape and enforced permission before another call.