diff --git a/modules/nats/cmd/nats-tools/removal_test.go b/modules/nats/cmd/nats-tools/removal_test.go
index 9fa7008b..3e211b27 100644
--- a/modules/nats/cmd/nats-tools/removal_test.go
+++ b/modules/nats/cmd/nats-tools/removal_test.go
@@ -12,6 +12,8 @@ import (
 	"testing"
 	"time"
 
+	"git.novox.be/novox/mesh-sdk/go/buscompose"
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
 	"github.com/nats-io/nats-server/v2/server"
 	"github.com/nats-io/nats.go"
 	"github.com/nats-io/nats.go/jetstream"
@@ -25,25 +27,23 @@ import (
 func TestTheRemovalToolsChangeOnlyWhatTheyAreAskedAndTheGrantAllows(t *testing.T) {
 	dir := t.TempDir()
 	conf := filepath.Join(dir, "nats.conf")
+	// Issue 1126 B5: the tools' grant as the mesh composes it for this module's word (mesh-sdk BusRemovalGrants), never
+	// a list written here, so the test proves the composed grant is enough and no wider.
+	grants, err := buscompose.BusRemovalGrants([]string{catalogue.RemovesControllerLeftovers, catalogue.RemovesEngineActs},
+		[]string{"novox"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	allow := `["` + strings.Join(grants, `", "`) + `"]`
 	if err := os.WriteFile(conf, []byte(fmt.Sprintf(`listen: "127.0.0.1:-1"
 jetstream { store_dir: %q }
 accounts { MESH { jetstream: enabled, users: [
   { user: "admin", password: "admin" },
   { user: "nats-tools", password: "tools", permissions: {
-      publish: { allow: [
-        "$JS.API.CONSUMER.INFO.DEAD_LETTER_NOTICES.controller",
-        "$JS.API.CONSUMER.DELETE.DEAD_LETTER_NOTICES.controller",
-        "$JS.API.STREAM.INFO.ASSIGNMENTS",
-        "$JS.API.STREAM.DELETE.ASSIGNMENTS",
-        "$JS.API.CONSUMER.INFO.EVENTS.controller-merges",
-        "$JS.API.CONSUMER.DELETE.EVENTS.controller-merges",
-        "$JS.API.STREAM.INFO.KV_mesh-controller_rollouts",
-        "$JS.API.STREAM.DELETE.KV_mesh-controller_rollouts",
-        "$JS.API.STREAM.INFO.KV_mesh-host_acts",
-        "$KV.mesh-host_acts.>" ] },
+      publish: { allow: %s },
       subscribe: { allow: ["_INBOX.nats-tools.>"] } } }
 ] } }
-`, filepath.Join(dir, "js"))), 0o600); err != nil {
+`, filepath.Join(dir, "js"), allow)), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	opts, err := server.ProcessConfigFile(conf)