Read the class assignments in that diagram, not the arrows. The LLM node and the Review node share the same `ai` class, Code Gates carries a guard class of its own, and Approval is a person [12]. Three stages sit between reasoning and the tool call, and only two of them are outside the model [14]. The path went from four nodes to eight [13]. Two of those additions can refuse a call for reasons the model cannot influence, and that is the part doing work.
The post is right that an instruction to confirm before important changes is not a security boundary [3]. Prompt-as-policy has roughly the enforcement properties of a code comment.
Where I would push on the design is the example check. `risk_ok = diagnosis.severity in {"low", "medium"}` reads a field the model filled in [10][9]. Schema-constrained output fixed the parsing problem, but the authority stayed exactly where it was. For the gate to hold under an adversarial or merely confused input, severity has to be computed from facts the model does not author: which tool was selected, which resource the parameters point at, whether that resource is production, how many rows the write touches. The model's own severity estimate then feeds logging and triage instead of opening the door.
The RAG check has the same shape. `citation_id in retrieved_documents` proves the identifier came from the retrieval set [11]. Whether that document actually supports the sentence attached to it is a separate, harder question, since entailment costs far more to test than membership. The supplied text breaks off mid-sentence at that point [11], so I will not guess at the rest of the author's argument.
The benefit list attached to code-first routing is lower latency, lower cost, easier debugging, predictable behavior and deterministic regression testing [8]. That claim rests on the mix of tasks routed, not on agents as a category. It transfers if the `has_known_failure_signal` branch catches most of your traffic [7]. If it catches little, you have added a classifier, kept every model call you had, and pushed the remainder into a queue of people, because `human_review` is the fallthrough [7]. The branch ratio measured on real tickets is the number to have before promising anyone a cost reduction.
In my context the guard runs server-side, inside the tool, on the same side of the call as the state change, and it re-checks at execution rather than trusting a decision taken earlier in the loop. A gate living in the agent process can be routed around by the model selecting a different tool. The separation the post asks for between reasoning, validation, authorization and execution [5] only holds if authorization is code the model cannot address. The ordering in the diagram is right; where the guard node is deployed decides whether it is one.
