The interception sits on the message, not on the model. When an agent forms an intent to call an endpoint or drop a table, OpenLeash reads that intent and picks one of three outcomes: block it outright, hold it while it asks the user, or pass it through [3][9][10]. Brin's worked example is the silent database deletion, the case where the agent is doing exactly what it was told and nothing in the chain was built to check first [9].
Two kinds of policy are running inside the same product, and they do not carry equal weight. The deterministic half is configuration: acceptable API endpoints, acceptable destinations, a payment ceiling above which a human has to authorize, all amendable at any time [8]. That half holds no matter how the agent phrased its request, because the check is on the destination and the amount. The other half is a risk judgement about a natural-language intention, and SecurityWeek's profile carries no false-positive rate, no latency figure, no numeric payment threshold, and no account of what happens when an injected instruction is written to look routine [12].
The escalation path is what I would test first. Brin's named audience is people who ship software without writing a line of it and with no security background, using Claude Code or Cursor to build agents [7]. That same user is the adjudicator whenever the classifier is unsure [13]. Effectiveness is therefore bounded by prompt volume: a control that queries a non-expert many times a day converges on approval [14].
Scope, stated plainly. One developer, a product described as still under development, several hundred personal users, at least four organizational deployments, and roughly two months of roadmap left by Brin's own estimate [5][6]. That is not a validated control and should not be priced as one. What it is is evidence about where the checkpoint is moving. Brin says coverage spans in-house, cloud, and third-party agents, intercepting the traffic between agent and network asset [4], which means the enforcement point does not need to know whose model is running or who wrote the prompt [11]. Agents inherit their user's permissions and none of the user's situational awareness [2], so the asset side of that conversation is the only place where the gap is measurable: the outbound call to an API, a database, or a payment rail is countable, loggable, and refusable, while the model behind it changes without notice.
Everything deterministic in that configuration is worth copying into whatever agent runtime you already operate. The intent classifier needs someone other than its author to try to break it.
