This seems like a fundamental misunderstanding / over estimation of the guarantees OAI and MCP can offer. If 'confirmation' is a separate tool call ... it's a separate tool call. There's no scoping, there's no 'binding', nothing. When you hand control back to the model you hand control back to the model.