Feels like detection at the wrong layer. The injection is text but the damage is a tool call, so the thing worth constraining is which tools the agent can reach and under whose permissions. A detector at 95% still passes one in twenty straight through to an unconstrained tool.