Thanks, Kartik! That's a great observation. You're absolutely right that inspecting individual components isn't sufficient if the agent can still be induced to chain otherwise safe tools into a risky workflow. That's actually one of the motivations behind Warden in Bulwark. It analyzes agent assemblies, capability combinations, and privilege boundaries rather than evaluating tools in isolation. The policy layer and "safe parts, dangerous combinations" problem is exactly where I think AI security needs to evolve. There's definitely more work to do around prompt-injection-driven tool orchestration, and it's an area I want to keep expanding. Thanks for raising it!