The policy layer in Sonjomon, Bengali for restraint [1], is deterministic code installed as ADK's `before_tool_callback`, and returning a dict from that callback cancels the tool call and hands the dict back to the model as its reason [8]. That is the config detail carrying the design. The model cannot execute what the policy denied, and it is told why instead of retrying the same command in a loop [8]. It also never supplies its own risk number: it proposes an action name and a registry in code returns the blast radius, on the author's reasoning that a confidently wrong model could otherwise talk itself into a rollback by labelling it low risk [6].
The other axis is softer, and the author lists it among the things he got wrong. He set the ACT floor at 0.90 before watching the model behave, and Gemini's self-reported confidence for a well-evidenced diagnosis clusters between 0.85 and 0.95 [17]. The midpoint of that band is 0.90 [18]. So the threshold sits in the middle of the distribution it is meant to cut. A rollback is graded high risk because it shifts production traffic, and a needless one during a real outage extends the outage [4], which is precisely the tier boundary where a floor that separates nothing does damage.
For 95% to justify acting alone, that number would have to behave like a frequency: of the diagnoses reported at 0.95, about 95 in 100 survive independent checking. Fourteen live incidents against one deliberately fragile Cloud Run service cannot establish that [11], and the write-up does not claim it can. What would have to be true is a record of self-reported confidence against verified outcome, bucketed, over enough incidents to give each bucket weight. Until that exists, the confidence axis is a heuristic wearing a decimal point.
The blast-radius axis needs no calibration. Deleting data is classified critical and no confidence level unlocks it [5], which is a statement about the action rather than about the model, and it stays true when the model version changes. The IAM result is the other durable finding: the agent held `run.admin` on exactly one service and still could not update it, because Cloud Run needs `artifactregistry.repositories.downloadArtifacts` to pull the image for a new revision, and that gap surfaced only because the agent tried, failed, and logged the exact permission [15].
The shape of a refusal is what these systems should be judged on. A log line reading `confidence too low to even recommend`, at forty percent on ambiguous signals, is easy for any gate to produce [16]. The refusal worth having arrives with a reason a human can act on, and the author credits that to inference his registry and prompt did not contain [12].
