Agreed. Authorization is the stated gap, but the deeper problem is the entity requesting the spend sits downstream of untrusted content. Its intent is compromisable via prompt injection. Session caps get reset with a new session. Per-call limits get defeated by many small calls. Human approval fails because the purchase description is also generated by the compromised model. This is Living-off-the-Land for agents: legitimate capability, valid credentials, authorized channels. IMO, the behavioral pattern is the anomaly and nobody's instrumenting for that yet