To prevent automation bias and Time-of-Check to Time-of-Use (TOCTOU), a single-use, short-lived execution token is bound to the SHA-256 digest of (tool_name, target_id, amount, currency, nonce, expiry). The LLM never touches the execution token, and if one argument differs, the token fails and the deterministic worker does not submit the signed payload.