Review the complete proposed call
A reviewed invocation must show the complete operation and argument set, including target identity and expected version where relevant. Present that proposal to the authorized user and require explicit confirmation before execution. Tool or UI selection does not grant authority, and a model-generated suggestion is not consent. Never let an agent construct a privileged arbitrary call or bypass the operation schema.
The server validates the invocation again at execution and applies ordinary receipt/replay rules. See scenarios, operation permissions, and the reviewed AI recipe.