A runtime security layer that sits in the agent's tool-call path and checks the whole sequence, not single calls — blocking, redacting, or holding a step the moment a chain becomes a breach.