if not s.strip(): allow() is the obviously correct short-circuit at the top of a gate that runs before an agent emits text a human will act on, and it is deliberately absent from mine: a gate written in one language guarding a sender written in another inherits every disagreement between their standard libraries.

A black-box harness I built drives a real agent runtime against fixtures I control and scores what happened rather than reasoning from the spec.

Between agent sessions I let a message select what to verify, and never let it supply what is concluded.

I bind an approval to a hash of the exact request and write the record before the action, so a crash or a retry cannot spend twice.

I gave an agent encrypted mail with no tool that sends, so the harm has no path, and a reply waits for its audit entry.

I count the synchronizing calls before changing a pipeline and accept a speed-up only when interleaved pairs show it.