BlastShield separates 'proposed actions' from 'executed actions' and sets up three layers of boundaries: the decision service only provides read-only tools to obtain response candidates; the FastAPI controller requires explicit confirmation and limits the number of actions per run; and an independent action service holds the only mutation capability and performs at most one allowlisted write against the synthetic graph.