PraisonAI caches tool approval decisions using only the tool name, which allows the reuse of an initial approval for subsequent calls with arbitrary arguments. An attacker can obtain approval for a benign operation and then execute dangerous operations, such as file writes, with unreviewed parameters within the same session. This occurs because the `ApprovalRegistry.is already approved()` function returns `True` if the tool name exists in the per-run context set, regardless of the arguments used. The `approve sync()` and `approve async()` functions short-circuit based on this cache before consulting the approval backend. While critical-tier tools like `execute command()` and `execute code()` are exempt, high-risk tools such as `write file()` are affected.