Action layer
The enforcement surface at the tool call, as opposed to the prompt layer, which tries to classify text before the model sees it. The distinction is the central architectural argument in agent security: prompt classification is an open-ended language problem an adversary can always rephrase around, whereas the set of actions is finite and enumerable. A control at the action layer blocks the dangerous call regardless of whether the injection that produced it was ever recognised — so even a fully hijacked agent is bounded.
See also PreToolUse hook · detection vs prevention · lethal trifecta
Related terms
-
PreToolUse hook
Agents & architecture
A callback the agent host invokes after the model has requested a tool call but before the call executes, handing over the tool name and arguments and…
-
Detection vs prevention
Testing & measurement
Detection notices something and produces a record; prevention stops it from happening. They are routinely conflated in agent-security claims, and the gap…
-
Lethal trifecta
Attack concepts
Simon Willison's name for the combination that turns an agent into an exfiltration engine: (1) access to private data, (2) exposure to untrusted content…
Agents & architecture
Where the attacks above actually land. The vocabulary here is worth precision, because the difference between "the model decided" and "the tool ran" is the difference between a risk and an incident.