Agent control planes

Tool-boundary enforcement cut trace failures from 57.6% to 0.2% in a 3,621-trial study

Three separate evaluations, collected in one dev.to post, keep landing on the same defect, which is that the reviewer runs after the side effect. Moving the deny to the tool call is a runtime change, not a prompt change.