AI Agent Tools Are Entitlements. Govern Them Like It.
Per-user OAuth answers who the user is. It doesn’t answer which tools they should get through the agent. Treat each tool as an entitlement, requested, approved, reviewed, and revoked like any other access.