How does Catalyst ensure that a compromised agent identity cannot escalate privileges through MCP tool chaining?

Catalyst evaluates each tool invocation independently against the agent’s authorized policy, not the cumulative chain. Even if tool A returns data that influences tool B, Catalyst re-checks authorization for tool B using the same agent identity. This prevents privilege escalation via tool chaining. Additionally, Catalyst records every tool call in an immutable audit log, so any anomalous chain can be traced back to the initiating agent identity.