Should you guard an AI agent while it's still making its plan, or just before it acts?

This explores two places to defend an agent system that plans and then acts: watching the signals that shape the plan before a workflow exists, versus checking the finished workflow just before something irreversible happens. The corpus's answer is that they aren't rivals. Each catches attacks the other structurally can't see.

Start with why planning-stage defenses exist at all. In planner-executor systems, a crafted prompt can bias how the workflow gets assembled, with no system access needed. The FLOWSTEER attack raised malicious success by up to 55 percent this way Can prompts alone reshape multi-agent workflows without system access?. The contamination enters upstream, so a defense that only inspects the generated workflow arrives after the damage is baked in Can inspecting generated workflows catch planning-time attacks?. The planning-side fix in that note separates a prompt into its task, method, and framing intents and intervenes where instructions get organized. It cut malicious success by up to 34 percent, so it helps a lot but doesn't close the gap.

Workflow-level validation works from the other end. SafeFlow checks the assembled workflow at the commit point, right before an irreversible action, and reconstructs the whole risk picture that no single step holds Where should workflow validation gates be placed for safety?. The strength is the vantage point. Some risks exist only in the composition, and a step-by-step view can't see them. Every step can pass its own plausibility or protocol check while the workflow as a whole still fails, because local checks test different properties than end-to-end safety requires Can individual components pass safety checks if the system still fails?. Stateless per-action guardrails also can't express a rule like 'this is fine alone but not after that', since that needs history Can stateless checks ever catch sequence-level constraint violations?.

The same blind spot shows up in a neighboring setting. ColluSkill reached 96 percent average attack success against six scanners that score skills one at a time. It used scanner feedback to blunt each piece while the chain-level intent stayed intact Can attackers evade skill scanners by refining individual skills?. A related proposal is to make the unit of defense a revisable coordination episode, meaning actions linked by transfers and task authority, rather than isolated reviews Should defence units span multiple executions and agents?. Both point the same way. Defenses that see one piece at a time lose to attacks spread across pieces.

The corpus has no head-to-head numbers for the two approaches, so it can't say which one wins. What it does say is that the SafeFlow note calls commit-point validation complementary to planning-boundary and per-hop defenses, each seeing attacks the others miss. Planning-signal inspection is early and cheap but can only judge intent. Workflow validation is late and sees the whole picture, but it inherits whatever the planner was already steered into. The practical lesson is to layer them, with the last check placed where a mistake can no longer be undone.