Using Fast SLM Classifiers as Inline Payload Validators Before Agent Tool Execution

uriwa · reddit · 2026-09-22

The author shares a production-proven pattern from AgentMail for guarding agent tools: instead of relying on system-prompt instructions (fragile under prompt injection) or regex/keyword blocklists (brittle across languages), treat tool arguments as untrusted input and pass them to a dedicated fast classifier right before execution.

Flow: the agent decides to call a sensitive tool (e.g., sendMessage) → the server fires the extracted structured payload to a sub-second decision model (JEV small checkpoints, <300ms) framed as a structured allow/block evaluation → block halts execution with a 400 error; allow proceeds.

Why not a frontier model judge: 2-3s latency per tool call ruins responsiveness; small classifiers cost fractions of a cent per thousand calls so every mutation can be guarded; and the classifier only sees the action payload, isolated from adversarial chat context. For agents with real-world side effects (email, webhooks, financial transactions), an inline classifier at the tool boundary provides actual runtime guarantees.

Original post →

More from coding & agent

coding & agent channel →