User requestwhat the human sent
Frozen GLM-5plans the next call
before tool-execution
Tool classifierreads vs. effect calls
Wash ledgeraccount book
Destination checkvs. whitelist
LLM scope auditorvs. request
Tool executesthe call runs
after tool-execution
Account bookempty
Injection checkscans for planted text