Agents no longer only answer questions. They call APIs, move money, change records and run code. The moment an agent can act, the question changes from whether its answer is good to whether the action should happen at all.
Prompts are not controls
Instructions in a prompt are requests to a model, not enforcement. A model can misread them, be misled by content it reads along the way, or simply be wrong. A real control has to sit outside the model and be able to say no.
Check at the execution boundary
The dependable place for that check is the point where an action leaves the agent and reaches a real system. There you know the exact action, the identity of the agent and the inputs. A decision made there applies no matter how the agent arrived at the action.
What a decision point returns
- ALLOW: the action is within policy and can proceed.
- BLOCK: the action is refused and never reaches the system.
- ESCALATE: the action waits until a human approves it.
Keeping the answer to three outcomes makes it easy for agents to handle, easy for engineers to test and easy for auditors to read. Every outcome is recorded, so the decision point is also where evidence starts.