Reference Monitor
The component that checks every access and cannot be bypassed.
James Anderson's 1972 report describes this component with three requirements: it is always invoked, it cannot be tampered with, and it is small enough that somebody can verify it is correct.
Translated for agents: the agent cannot route around it, cannot rewrite the rule that governs it, and a human can understand why it blocked.
The third is the most forgotten, and it is the one that breaks real systems. A block nobody understands becomes noise, and noise teaches people to switch the protection off. An incomprehensible guard is defeated by its own user, no attacker required.
Read the article: Prompt injection already had a name in 1988