Where should workflow validation gates be placed for safety?

The third part of SafeFlow, after taint attachment and propagation, is that it "performs workflow-level validation to reconstruct the global risk context before irreversible actions are committed." Two design choices sit in that clause. The first is scope: validation runs over the workflow, not over a message. The validator assembles what the taints and the collaboration graph say about the path so far, and that assembled picture is the "global risk context". No single step holds it, because each step holds only a fragment. The second is timing: the check is triggered by irreversibility, not by every step. The commit point is where harm becomes real (data leaves, a tool side-effect executes), so it is where a gate has the most information and its last chance.

This is a third answer to a placement question the vault already answers twice. Can inspecting generated workflows catch planning-time attacks? puts the defense at the planning boundary, between instruction and organization. Do internal agent hops in pipelines need security monitoring? puts a gate on each channel. SafeFlow puts one at the effect boundary, with the whole flow in view. Each position sees what the others cannot. The planning boundary sees intent before it is organized, hops see instruction-shaped payloads in flight, and the commit point sees the composed workflow, which is the only place a fragmented objective is visible as one thing. Whether the three are alternatives or layers is the open tension recorded in ops/tensions/. Two later notes add positions to the inventory. Does chain-level inspection close the cross-skill attack blind spot? inspects the whole chain of skills in place of each one and leaves attack success above one in five. Can memory poisoning compromise decision-making even with authorization layers? checks a licence at the effect without reading the workflow, and holds unsafe actions at 0 percent while the reviewing agent is bypassed in every trial (memory poisoning only).

It also fits two things the vault already holds. Irreversible actions are exactly where the fourth condition of What makes an AI system truly safe in practice? fails, so a gate there concentrates checking where repair cannot help. And commit points are natural candidates for the confidence-routed escalation in Does targeted human oversight beat both full autonomy and exhaustive review?, though the excerpt says nothing about escalating to a human. Can governance rules embedded in runtime memory actually protect autonomous agents? describes external-action checks in a deployed persistent agent, the same placement in a working system.

The limits are practical. Someone has to define which actions count as irreversible. If the validator is an LLM reading the reconstructed context, it inherits the problems in Can we detect when models hide their reasoning?, because a rewritten workflow reads clean. The authorization result is the contrast case: its check does not run through any agent's judgment, so the reviewer's failure does not reach the action. And waiting for the commit point lets wasted work run before a rejection.

What the excerpt does not give. How the validator decides, its latency, and its false-positive rate.