I went looking for a better runtime check and found a different way to think about the problem.
I have spent a lot of time recently thinking about what an AI agent should be allowed to do.
Reading data is one thing. Writing durable state is another. Sending an email, approving a refund, changing a production configuration, or deleting a record moves farther along the same spectrum.
The usual answer is to put a guardrail in front of the dangerous operation.
That makes sense, and I have built examples that work exactly this way.
