What belongs in the tool schema instead of the reviewer prompt?
Where do you draw the line between something an agent should be told not to do and something its tools should make impossible?
One paper appendix gives a clean example. An author agent built an intraday feature around a full-day volume denominator. A reviewer agent focused on the causal-sounding intent and approved it, even though the implementation read future bars.
The later AQuA design moved that boundary into the action space. The agent composes a fixed set of causal operators, and the full-day normalizer is not available as a valid expression.
A reviewer is useful when the failure is visible and it has a genuinely different basis for judgment. A schema is stronger when the invalid candidate should never exist. Adding another model can make a pipeline look checked without changing that action space.
The restriction only closes this route inside the admitted language. It is not proof that the whole system is leakage-free.
For agent systems you have worked on, what property stopped living in the prompt and became a type, permission, or tool constraint instead?