Action-Time Authorization
Checking whether a proposed agent action is authorized at the exact moment before the tool call, API request, or side effect executes.
Plain English
The system asks, is this specific action allowed right now, with these arguments and this source of authority?
Example
Before a deployment agent runs `terraform destroy`, a runtime guard verifies task scope, target environment, approval state, and policy.
Why it matters
Prompt-only safety is too weak for agents that act; runtime authorization creates an enforceable boundary before external systems change.