Great walkthrough of the Doberman proxy. The three-tier PASS/AUTH/BLOCK model maps well to real agent operations where some tools are low-risk, others need human oversight, and a few should never execute regardless of authorization. I am curious about the AUTH token flow in practice. If the agent runs asynchronously or as a background task, does the AUTH decision hang until a human reviews, or does it queue and retry? The ASR and FPR metrics are a welcome addition. Security discussions too often stop at the policy level without measuring actual effectiveness. The rule ordering strategy mirrors deny-by-default with escalation paths, which is clean. One consideration for scale: when an agent has access to dozens of MCP toolsets rather than three, the rule maintenance overhead grows. Pattern-based rules that apply across tool boundaries seem more maintainable than per-tool allowlists. The laboratory framework here is a solid foundation for testing those patterns before deploying them.