Runtime monitoring (continuously observing standard output, log streams, or behavioral metrics) enables humans to interrupt execution at any moment; post-hoc logs can only be used for attribution after the incident ends and cannot provide real-time control capability.