This still does not seem to fix the OP vulnerability? All tool call specs will be at same privilege level.