I went looking for a better runtime check and found a different way to think about the problem. I have spent a lot of time recently thinking about what an AI agent should be allowed to do. Reading data is one thing. Writing durable state is another. Sending an email, approving a refund, changing a production configuration, or deleting a record moves farther along the same spectrum. The usual answer is to put a guardrail in front of the dangerous operation. That makes sense, a...