One policy set, six places it binds

• The turn you submitted
• Each tool call before it runs
• Every tool result

Blind to Anything not going through this harness, and sessions that run in the vendor's cloud rather than on the laptop.

• Whatever you post to it
• One endpoint per surface
• Model traffic, if you proxy it

Blind to Calls your code makes without asking. It answers questions; it cannot intercept what it is not shown.

• Prompts and completions
• OpenAI, Anthropic, LiteLLM, LangChain
• Sync, async and streamed

Blind to Tool calls. It patches model clients, so a tool your agent invokes directly never reaches it — use one of the other four for that.

• The call and its arguments
• The schema it was approved under
• What the server sent back

Blind to A server nobody pointed it at. An undeclared tool becomes a finding the first time it is called, not before.

• Each tool call in the run
• Retrieved documents
• Model input and output

Blind to Nodes you did not wrap. Escalation maps to LangGraph's own interrupt(), so there is one pause mechanism rather than two.

• A repository, without running it
• A session transcript
• A policy, before it ships

Blind to Runtime. It reads code and records; it stops nothing that is already executing.