A tool call runs inside an agent's own session, so the network sees a connection already open, and the endpoint sees a program it has watched all day, each reporting the moment truthfully and each reading it as normal. The MCP gateway is the only source inside the call, reading the tool description, the argument, and the result on one request ID, and it can refuse the call before invocation. Agent telemetry names the human and the prompt behind it, while the network offers independent proof of a boundary that was never enrolled. Triangulated, the sources establish who made the call, what fraction of the agent's actions the boundary actually covers, and that a poisoned tool moved credentials across the boundary, decided once at the boundary rather than in the alert queue.
.avif)
