PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes "allow_dangerous_tools=True". The normal "recipe.run()" path enforces this with "_check_tool_policy()". The streaming path, "recipe.run_stream()", loads the same recipe, checks dependencies, and then calls "_execute_recipe()" without running the dangerous-tool policy check. As a result, a recipe that honestly declares "execute_command" in "TEMPLATE.yaml requires.tools" is denied by "recipe.run()", but reaches the execution engine through "recipe.run_stream()" with "allow_dangerous_tools=False". The local PoV uses a harmless "printf" canary, explicitly unsets "PRAISONAI_AUTO_APPROVE", and avoids network access.