Your allowed list has two entries nobody would argue with. One prints a file to the screen. The other fetches a URL, because the agent has to read documentation like everybody else. Then one line goes past the guard: print the file holding your environment variables, pipe it into the fetcher, post the bytes to an address you have never heard of. Every program in that line was allowed. No rule was broken. Your keys are on somebody else’s server, and the permission model you wrote worked exactly as written.

A trade name is not a hazard class

Nothing in a cleaning store is safe because of what is printed on the front of the bottle. Safety comes from a second description underneath, which says what the stuff does: burns skin, catches fire near a spark, gives off gas when it meets an acid. That description is a class, and the rules are written against classes, including the ones about what may never share a bucket. You cannot read the class off a brand name. Two bottles, each of them harmless on its own shelf, tipped together by somebody in a hurry, will empty a room.

An effect guard reads a tool call the same way. It takes the whole line — the pipeline, the redirects, the arguments — and works out the effects it would have: this one reads a secret, this one deletes files, this one sends bytes out of the machine. The rules are written against those effects, never against the program names. The line above comes back carrying both a sensitive read and an outbound connection, which is a combination the policy refuses, so nothing runs at all. And it is deterministic: the same line gets the same verdict every time, block on a certain violation, otherwise handed down to the sandbox and the approval flow you already have.

A guard in doubt must never widen permissions

Classifying by effect survives change, which is the whole point. Flags and arguments move constantly, and a list of trusted program names is a list of guesses that goes stale the first time somebody learns a new option. The effect does not move. Whatever the flag says, either that line reads the file or it does not.

That is what decides how much you are willing to leave running while you sleep. Reading every command yourself does not scale, and handing over a whole shell is a permission you cannot even describe. Effects give you the middle: refuse the certain violations, pass everything ambiguous down to the sandbox or to a person.

One mistake ruins it. If the parser meets something it cannot follow — an odd substitution, a script wrapping a script — and the guard treats “not understood” as “not forbidden”, then every gap in the parser has quietly become a permission. Not understood has to mean delegated or blocked, whichever the policy says. The same shape appears one level up, on generated code: a verifier inspects it before it touches the real environment, spots known-bad patterns, and can send it back for another attempt instead of running it. That is not a test. A test tells you what already happened.

Cheap checks are the ones that stay on

A check that runs on every single action has to be cheap, or it ends up running on a sample, and a sampled guard is a guard with holes in it. Parsing is cheap. But not everything arriving at an agent is a command line, and you cannot derive typed effects from a paragraph of English. There, the same instinct shows up differently. SecurityLingua reuses a small model trained to compress prompts: the scoring that decides which tokens are redundant also marks which ones are anomalous, and that signal exposes the intent hiding behind a jailbreak, at negligible overhead and up to 100 times lower token cost than the usual approach of putting a large guardrail model in front. It stays probabilistic, so it screens rather than rules, which is why it belongs in front of the oldest problem here and not in place of the deterministic parts behind it.

None of this asks the agent anything. That is the feature. A stated intention is a claim, and a claim can be shaped to get past whoever is reading it. What an action does when it runs cannot.