The common misconception is that the model calls the tool. It does not. It emits a structured request naming a tool and arguments; your code decides whether to execute it and returns the result as another message.
That distinction is the whole security model. The model only ever asks, so permission checks belong in the code between the request and the action.