A response is not the end of the workflow
An assistant returns information for a person to review. An agent can continue by selecting a tool, generating a command, changing a file, installing a package, or contacting a service. The security question moves from what the model said to what happened next.
The session is the unit of understanding
An isolated command may look ordinary. Its meaning can depend on the originating request, earlier tool activity, context changes, and the destination of the resulting action. Session visibility connects those events.
Control belongs near the action
Prompt protections remain valuable, but a concrete action creates a clearer enforcement point. Runtime security can evaluate supported actions against explicit policy before execution, then preserve the decision as evidence.
A practical design question
For every agent workflow, ask which actions can change a system, expose information, install software, or invoke an external capability. Then decide which require visibility, evaluation, or enforcement.