A more reliable direction for constraining AI agents is to enforce controls at the tool-call level, intercepting, auditing, and authorizing every invocation of an external tool or access to a sensitive resource.