I build agent tooling and kept hitting the same thing: tools validate that a request is well-formed, but almost nothing checks that this caller was authorised t

I build agent tooling and kept hitting the same thing: tools validate that a request is well-formed, but almost nothing checks that this caller was authorised to do this specific action. So I wrote a scanner for that one shape, a model-controlled parameter reaching a consequential sink (payments, deletion, shell, SQL, egress) with no authorisation check dominating the path. Then I ran it across 25 pinned repos, 23,476 files, and hand-triaged every finding. The part I'd most like scrutinised: the first run was 81% precise. 12 of 63 findings were wrong. A Kubernetes rule matched Elasticsearch clients at HIGH severity. A SQL rule caught hardcoded DROP TABLE and missed caller-controlled execute(query), exactly backwards. I've since found and corrected more, including tools guarded by human-in-the-loop primitives I didn't recognise. Every correction is in the study. What it can't do, stated plainly: guard soundness is undecidable, so it checks that a guard call dominates the path and shares a parameter with the sink — not that the guard is correct. It covers three agent architectures out of seven; custom agent loops are NOT COVERED because that heuristic produced 10 false positives out of 10 candidates and I dropped it rather than ship it. pipx run actenon-scan scan . Zero runtime dependencies, nothing uploaded, Python and TypeScript. If you can make it report clean on something that obviously isn't, I'd genuinely like the case — the benchmark has a soundness suite specifically for that and it's the part I trust least.