Honestly, neither. Warden runs before anything executes. It just reads the config (LangChain, CrewAI, Assistants, .mcp.json) and looks at what the agent can do once it's all wired together, so it's framework-agnostic but can't stop a call in flight. The thing I look for is combinations, not tools. Read-secrets is fine. Send-email is fine. Both together is an exfil path, and if the same agent also reads a webpage, someone else gets to trigger it. Then it'll strip the config down to least privilege and fail CI on it. Runtime is the gap and it's the harder half. How are you doing it? Different config per task, or decided live at dispatch?