When AI reasons across systems, static permissions fail and intent becomes the real attack surface.