Don't try to make the model unconfusable—limit what the deputy can sign. Test the tool gateway with the exact malicious calls, model out of the loop; that should be CI, not a vibe check. "Agent attempted, layer blocked" is a pass for architecture, not a fail for the model.