The Gate: The Model Proposes, Code Disposes

Excessive agency was sixth on the OWASP list for 2025. In the 2026 edition it is third (OWASP, 2026). That movement is not a change in the threat. It is the industry noticing what it shipped: agents holding standing credentials, calling tools on the strength of their own judgement, in systems where nothing between the model's decision and the side effect ever says no.

The gate is that something.

The shape of the thing

A tool call arrives at your system as a request from a model that may have been talked into anything. Most frameworks treat it as an instruction and execute it. The gate treats it as a proposal, which is a different noun with different rights.

A proposal is evaluated before it becomes an invocation. The evaluation is done by ordinary code, against ordinary data, and produces one of three outcomes.

Nothing in that path consults a language model. Not to classify the request, not to assess the risk, not to double-check the first model's work. A second model asked to police the first is one prompt away from agreeing with it, and you have bought latency instead of a boundary.

That includes the system prompt. Telling the model to ignore instructions found in documents is worth doing and it works remarkably well: appendix E.5 measures it, and one sentence took a live agent from acting on nine of thirty-two injections to two, and a larger model from thirteen to none. Write the sentence. Then notice that the same sentence gave two different answers on two models from the same vendor in the same week, against four payloads written by one person with no adaptive pressure at all. You cannot tell a regulator which of those numbers your system produces, and you cannot enumerate the inputs that would change it. That is the difference between a good mitigation and a boundary, and this chapter is about the second thing.

What the gate actually reads

Three inputs, and the third is what makes this more than role-based access control.

The tool being called. Named, with a policy attached. If no policy exists for a tool, the answer is deny. Default-deny is not a stylistic preference here; it is the property that makes the whole design survive a team that adds tools faster than it adds policies, which is every team.

The capabilities the caller holds. Chapter 8 built these: per-task, time-bound, derived from the user rather than a service account. The gate checks them, it does not mint them.

The provenance of every argument. Chapter 6 built this. Each argument carries the origin of the data that produced it, and the taint propagates. This is the input that no conventional authorisation system has, and it enables the rule that does most of the work in practice:

An argument derived from untrusted content may not be passed to an irreversible action.

Read that as an engineering rule rather than a principle. The refund amount came from a customer-uploaded PDF. The email recipient came from a web page the agent fetched. Under that rule both calls stop, and they stop without anyone having decided whether the content looked suspicious. Nobody read the payload. Nobody needed to.

The types

The proposal and the verdict are the two records the rest of the chapter hangs off.

public sealed record Proposal(
    string ToolName,
    IReadOnlyList<Argument> Arguments,
    CapabilitySet Held);

public sealed record Argument(string Name, object? Value, Provenance Origin);

public enum Outcome { Allow, Deny, Escalate }

public sealed record Verdict(
    Outcome Outcome,
    string DeniedBy,
    string ReasonForModel,
    string ReasonForAudit);

Two reason strings, deliberately. ReasonForModel goes back into the conversation so the agent can do something sensible next. ReasonForAudit goes to the log and never anywhere else.

Keep them apart. A detailed denial is an oracle: tell the model that the call failed because the amount exceeded a four-hundred-dollar threshold on tainted arguments, and you have handed an attacker a free probe of your policy. "That action is not available" is the whole message the model needs. The audit log gets the sentence you would actually want during an incident review.