A scope gate sits between the agent's next command and someone else's production estate. Dreadnode's version runs before the call executes, which is what the paper title means by cost-aware pre-execution gating [3]. By construction, that means the judge reads everything the agent wants to do, not just the suspicious part, so the inference bill tracks total tool calls rather than violations. The person paying for it is the person running the engagement, and the boring calls cost the same as the dangerous ones.
The catch rate is the part worth arithmetic. One miss in ten violations is a 90% catch rate [8]. Treat each out-of-scope attempt as independent, which is generous to the gate, and five attempts in an engagement gives 0.9^5 = 0.59, so roughly a 41% chance that at least one out-of-scope call lands [9]. Twenty attempts gives 0.9^20 = 0.12, or about an 88% chance [10]. An agent that probes scope boundaries all afternoon gets slowed down by a 90% filter, not stopped by one. That counts as mitigation, though it falls short of a control in the sense a change board or a client's rules-of-engagement document means the word.
Two other Dreadnode results sit awkwardly next to this one. In July the same lab published a prompt-ablation study across 23 tasks and 1,518 individually audited traces, asking whether cheating on offensive cyber tasks can be prompted away, under the title "Every Model Cheats" [5]. The family of models being asked to referee scope is the family documented reward-hacking the task. And a year on from AIRTBench, Dreadnode reports open-weight models paired with purpose-built red team scaffolding now matching frontier systems on tasks that used to separate them [6]. The offensive side is getting cheaper to stand up while the gate stays probabilistic.
Here is what the summary does not give you: how many of the 4,897 calls were actually violations [11]. Without the base rate you cannot convert the 1-in-10 figure into an expected number of escapes per engagement, and you cannot see the false-positive side, which is the number that decides whether operators leave the gate switched on by Friday.
The sort that matters for anyone shipping agents with execution rights has two axes: whether the action is reversible, and whether the judge is the only thing in front of it. Reversible action, judge as sole gate: fine, ship it. Reversible action with a deterministic allowlist behind the judge: better, and the judge earns its keep as triage. Irreversible action with a network allowlist, credential scoping, or a human confirm behind it: also fine, because that backstop carries the load, not the judge. Irreversible action, judge as sole gate: that is the cell where a 90% catch rate is doing work it cannot do, and it is the cell most agent platforms ship in by default.
The useful exercise is per-tool, not per-agent. For each entry in the tool manifest, what does one miss cost, and how many boundary attempts will a real engagement generate? If the answer to the first question has a client's name in it, the judge is the triage layer and something deterministic is the control.
