Every guardrail points at the wrong thing

The big platforms ship real controls for AI. Read where each control sits. Every one of them guards what the AI does. None of them guards what the AI tells you.

AWS describes the policy layer of its AgentCore platform this way:

"Every agent action through Amazon Bedrock AgentCore Gateway is intercepted and evaluated at the boundary outside of agent's code - ensuring consistent, deterministic enforcement that remains reliable regardless of how the agent is implemented."

Deterministic. Outside the agent's code. Good engineering. Now look at the object: every agent action.

Google introduced its Agent Gateway in April 2026:

"Agent Gateway provides air traffic control to ensure interactions between agents and data is secure."

Anthropic's Agent SDK lists its permission system like this:

"Control which tools run automatically, which need approval"

AWS's open-source Strands framework now groups its controls under a heading:

"Gate tool calls with interventions"

Four vendors. Four checkpoints. All four sit on the action path: the tool call, the data access, the side effect. The newest AWS feature, temporal policies, goes further and reasons over a whole session, for example blocking a money transfer until an approval exists. Still an action.

Here is what none of those controls inspect: the sentence at the end. The summary telling you the migration finished. The report saying the audit found no issues. The final answer saying all 25 tasks are done. You read the answer and you act on the answer. On these platforms, nothing deterministic stands between the model and the claim.

You might say the grounding vendors cover this. Some do, partly. Contextual AI ships a model built to refuse when its documents do not support an answer. Cleanlab and Galileo score responses for errors. Every one of those sits beside an orchestrator built by someone else, and most of them grade with another model. I cover the trouble with a model grading a model in a later post.

We put the gate on the claim. Here is a real example from our own logs, 1 August 2026. A Merlin run finished 24 of 25 tasks and wrote 11 files. The model proposed a final answer saying the job was done. A six-line rule rejected the answer:

route              REJECT_UNSUPPORTED_CLAIMS
source             deterministic_guard_guard_3c
reason             full-success final is forbidden while task_summary
                   has pending or in-progress tasks

The rule did not read the prose. The rule counted open tasks, found one, and refused to let a claim of full success exist. The 11 files still shipped, with a manifest of what changed. Only the false sentence died.

Action gates matter. Keep them. A model with production credentials needs a fence around the tools. But the fence answers a different question. The fence answers "was the model allowed to do this." You also need an answer to "is the model telling the truth about what got done." Right now, on the platforms quoted above, you build the second answer yourself.

The test I use: pick any guardrail in your stack and ask what object the guardrail inspects. If the object is a tool call, the guardrail protects your systems. If the object is the final claim, the guardrail protects you.