A housing authority eviction-casework agent can draft correspondence freely but must be blocked from invoking the case-status-change tool unless a second, independent verification step has occurred. What kind of control does this require?

A tool-level access restriction attached specifically to the case-status-change tool, requiring a second independent verification before that particular tool can execute, matches the requirement precisely: correspondence drafting stays unrestricted while the one consequential action gets an extra gate. A general PAB policy limiting the agent's overall project scope operates at the resource-boundary level, restricting what projects or resources the agent can reach, not distinguishing between individual tools within an already-authorized scope, so it wouldn't create the tool-specific extra step the scenario requires. A Model Armor filter screening correspondence for inappropriate language addresses content quality in the drafting path, which the scenario says is already unrestricted, and has nothing to do with gating a separate, higher-risk tool call. A Skill Registry approval covering the agent's overall skill set is a one-time, install-time vetting decision; it confirms the case-status-change capability was approved to exist at all, but it doesn't impose an ongoing, per-invocation verification requirement each time that specific tool is about to be called. A scope caveat: the verification step itself needs to be genuinely independent of the agent's own reasoning, otherwise a compromised agent could satisfy its own check. As an operational check, an architect can attempt to invoke the case-status-change tool without completing the verification step and confirm the call is blocked while correspondence drafting continues to work normally.