When Guardrails Redirect: Blocking One Action Can Execute Another

Large language model (LLM) agents increasingly act through tools that cancel orders, modify reservations, and update accounts. To keep these actions safe, tool runtimes commonly combine two forms of control. Grammar- and schema-constrained decoding keeps calls structurally valid, whereas state-aware filtering changes which tools or arguments the model sees according to the current environment. However, validity alone does not establish that a surviving action is an authorized replacement for what the user requested. Consider a customer who asks an agent to cancel order A. If A is no longer pending, a state-aware filter may remove cancel(A) before generation while leaving another cancellable order B available. The model can then propose cancel(B), and the tool may execute it, even though B was never requested. The call is valid in the current state but unauthorized relative to the user's request. We call this conditional failure the Validity–Repair Gap and ask whether removing an unavailable requested action can causally redirect an agent to a different valid action. We answer this question through matched availability interventions on $\tau^2$-Bench, AgentDojo, and ToolSandbox. Each pair holds the model, conversation, database state, and decision point fixed, and changes only whether the requested action remains reachable. In the primary Retail setting, retaining cancel(A) causes the model to propose A, which the official tool rejects without changing state. Removing only cancel(A) instead causes the same model to cancel another order. This reversal occurs in all 122 eligible matched pairs, while both request-aware controls prevent every write. The same pattern reproduces across six model configurations, three benchmarks, and 13 mutating tool shapes. Having established that filtering can redirect the model, we next examine how a substitute is selected and admitted to commit. Controlled tests show that representation order can silently select among otherwise equivalent alternatives, while generic confirmation can approve a wrong-target proposal because it does not bind consent to the action that will execute. These failures have a common source. A final call such as cancel(B) does not record whether the user requested B or whether B appeared only after A was filtered out. A downstream checker that sees only the final call therefore lacks the history needed to make a request-relative authorization decision. This observation motivates a request-bound commit interface that preserves the original request, the permitted relation between request and proposal, and evidence naming the final action until the first side effect. The interface checks current executability separately from request-relative authority, and unresolved substitutions require action-specific confirmation or fall back without mutation. With supplied request–proposal relations, controlled decisions become invariant to representation order, generic assent no longer commits wrong-target actions, and accepted writes outside the supplied set fall from 143 of 540 blocks to zero. Taken together, our results show that state validity is not sufficient for authorization. The matched interventions establish this causal failure under controlled preconditions rather than its prevalence in deployment, and the interface assumes that the request–replacement relation is available. Nevertheless, the central design requirement is general. When a runtime changes the actions available to an agent, the authority for any resulting change must remain available until commit.