Enforce fully qualified, version-pinned tool names: the agent must call report_finance@v2.1, not just report. Tool resolution must fail closed on ambiguity — if two tools could match, block and ask for disambiguation rather than resolving to whichever comes first.

Validate the semantic intent of tool calls: a query tool should receive query-type parameters, not command-type parameters. A schema mismatch blocks the call before execution.

Maintain immutable logs of every tool invocation: tool name and version, full parameter payload, calling agent, session ID, timestamp, and outcome. These logs must be tamper-resistant.

Monitor for anomalous patterns: unusual tool-chaining sequences (DB read followed by external send), abnormal invocation rates, parameter values outside expected ranges, and calls to tools not in the expected set for this agent's task type.

Monitoring is detective, not preventive. A successful attack will be captured in the logs — but the damage may already be done. Monitoring catches attacks in progress or after the fact; it must be paired with active controls (MIT 01–06) to actually stop them.

S05 (Typosquatting) — blocked by fully qualified name enforcement. S06 (DNS exfil) — detected by parameter anomaly monitoring (base64-encoded hostname). S13 (EDR bypass via tool chain) — the immutable log captures the full PowerShell + cURL + API sequence that EDR missed.