Figure 4. Runtime enforcement in (A) AgentSpec[29] and (B) SAFEFLOW[34]. Protection depends on exposed state and rule coverage; recovery is limited to supported operations. SF: SafeFlow level.
