The code that's assembling the context to send to the LLM and gating its access to tools can check these deterministically.