S
Exactly. The tool gateway is where the security invariant needs to hold, regardless of what the model decides upstream. I especially like the point about testing it independently. Red teaming can expose how an agent reaches a dangerous action, while direct-call tests verify that the authority layer still blocks it. Both layers matter.