You'll notice
Design tool database read/write consent is now bound to the exact approved action and project slug
Consent for read_db, write_db and watch is now recorded as {action, slug} in tool state and re-checked at call time. If the tool's action or url has changed since approval, the call is rejected with a new db_target_changed error instead of silently running against a different target than the one the user approved.
This behavior is reachable on this build without any flag involved.