Prevent policy bypass: enforce AI agent tool-call permissions in production | saasbrowser.ai