diff --git a/src/agentegrity/adapters/base.py b/src/agentegrity/adapters/base.py
index 42fce5d..603dcb3 100644
--- a/src/agentegrity/adapters/base.py
+++ b/src/agentegrity/adapters/base.py
@@ -712,7 +712,12 @@ def _handle_pre_tool_use(self, data: dict[str, Any]) -> dict[str, Any]:
 
         self._append_capped(
             self._buffer.tool_calls,
-            {"tool": tool_name, "type": "tool_call", **tool_input},
+            # Spread the agent-supplied arguments FIRST so the trusted
+            # "tool"/"type" fields always win. This dict becomes
+            # context["action"], which GovernanceLayer's GOV-001 checks
+            # against the sensitive-tool set; letting an argument named
+            # "tool" override the real name would bypass that gate.
+            {**tool_input, "tool": tool_name, "type": "tool_call"},
             "tool_calls",
         )
         self._buffer.tool_usage[tool_name] += 1