Seven

The human-in-the-loop gate for destructive tools is the part most teams skip, and your PR example shows why review alone doesn't catch it. One pattern that pairs well with approval gates: log the resolved model + endpoint alongside every tool call. When an agent misbehaves you want to know not just what it did but exactly which model produced the decision — reproducibility matters as much as permissioning here.

Solid overview. One thing I'd add to the selection criteria: whichever model you pick, it's worth verifying periodically that the endpoint actually serves what it claims — especially with third-party gateways. A small behavioral smoke test (a few fixed prompts at temperature 0, diffed against the official API) catches silent downgrades that benchmark tables never will. Model choice is a starting point; verification is what keeps it honest.