My thinking so far is that Sonde only tries to describe the capability surface of the tool: commands, inputs, outputs, and discovery. In other words, what the tool can do in principle.
Authorization feels like it belongs to a different layer that sits between the agent and the tool: something that can apply task context, policies, or sandbox constraints before execution.
So the manifest would help the agent construct a valid call, but it shouldn't imply that the call is allowed. The enforcement layer still decides that.
Your filesystem example is a good illustration: the manifest could describe `delete_file`, but whether the agent is allowed to call it on a specific path would depend on the environment or policy around the tool.
Right now I'm mostly exploring the capability contract because that surface feels under-specified in current tooling. But I agree that the authorization layer is where a lot of the real safety and control questions live.