Your agent didn't hallucinate; it exceeded its authority

Analysis argues content filters can't tell whether an agent was authorized to issue a refund, touch a production system, or commit the company externally — and most enterprises only solve the output-safety problem, not authorization.