Agents usually fail because nothing executable sits in front of the tool call. “Please be careful” in a prompt is almost a no-op: the runtime cannot see it, and cannot compare it with a threshold.
Put the gate before the tool runs. Treat the impending action as state: tool name, arguments, user goal, relevant permissions. Ask three questions — action as choice (allow / confirm / block), risk as score (low / medium / high), dangerous-tool as noul (0–1). Deletes, wires and production overwrites should lean block. Read-only search can allow. Mail or outbound HTTP can confirm.
Write thresholds in the runtime, not in prose. Example: block when noul ≥ 0.85 or score is high; confirm in the middle; allow when risk is low. Then a confident-sounding model still cannot run the tool if the number misses the line.
Make failures replayable. Log state, questions, outputs and the final action so the agent can be audited. JEV fits this gate because the output is already types and probabilities — you do not scrape fields out of a self-check monologue.
The gate is not the whole security story. Permissions, sandboxes and a tiny tool surface still matter. JEV answers “should this step happen?”, not “how much damage if it does?”. You want both before an agent touches a real system.