Honestly, neither. Warden runs before anything executes. It just reads the config (LangChain, CrewAI, Assistants, .mcp.json) and looks at what the agent can do once it's all wired together, so it's framework-agnostic but can't stop a call in flight.
The thing I look for is combinations, not tools. Read-secrets is fine. Send-email is fine. Both together is an exfil path, and if the same agent also reads a webpage, someone else gets to trigger it. Then it'll strip the config down to least privilege and fail CI on it.
Runtime is the gap and it's the harder half. How are you doing it? Different config per task, or decided live at dispatch?
Kartik N V J K
AI Developer | Making AI reliable, trustworthy & accessible to everyone | Active community contributor
Least privilege for agents is underrated. Most incidents I've seen came from an agent holding a tool it never should have been handed. I started scoping tool access per task instead of giving the agent the full catalog. Are you enforcing that at the framework level or with an external policy layer?