Cert-gating every tool call: zero-trust for AI agents

Two days ago, Anthropic launched Managed Agents — a hosted runtime where tool execution runs in per-session sandboxes with always_ask permission policies that route sensitive tool calls through a human approval step. It is a real improvement over the previous status quo. It also catches roughly the same fraction of real attacks that a string allowlist catches, and for the same reason: the gate is checking the surface form of a tool call, not the provenance of the inputs that shaped it. A prompt...