The runtime interceptor approach is solid for catching loops, but there's a complementary layer worth considering: pushing authorization to the credential boundary. If each tool call requires a fresh signed capability scoped to specific params, loops that replay the same call hit a spending policy wall instead of draining a balance. Same 'hard stop outside the model' philosophy, just enforced before execution rather than monitored during it.