A deterministic action-veto gate is what stops a hallucinated end_call — a voice agent hung up before the caller spoke

A voice agent ended its own call the moment it started — the model called end_call before the caller said a word. This is not a problem a better prompt fixes. It is an issue of trusting the model at the boundary of an irreversible action. The answer: put a deterministic gate on end_call, and on every other irreversible tool (transfer, refund, delete), outside the model, at the tool boundary. gate.cat describes the shape well — an action-veto that is model-agnostic, built as a deny-list plus an exec-check plus a human-in-the-loop, inspecting the tool call before it executes. Because it runs outside the model it protects any agent the same way no matter which model is driving it. That is the right place to be wrong in the safe direction, because the failure here was a hallucinated tool call: the model had full confidence in an action that should never have happened. The gate is allowed to veto; the model is not the final say. Two more pieces follow from the same pattern. Protect silent calls: no terminal action runs while the caller has not spoken, and every terminal message finishes before the disconnect (AVA-AI-Voice-Agent-for-Asterisk does exactly this). And log every blocked call, so when a new model or a prompt update starts tripping the gate you see it as a regression you can diff instead of a release that starts hanging up on callers. Edge cases worth being honest about. A fixed window (ignore end_call for the first six seconds) looks attractive but is fragile — latency, long silences, slow speakers all break it. Prefer a conversation state machine keyed on whether the caller has actually spoken and what the last non-terminal intent was. And the gate is only as good as the deny-list: the risk is the irreversible action you forgot to list. That is why the human-in-the-loop and the blocked-call log are not optional extras; they are the part of the mechanism that catches the case you did not think of. The principle generalizes: for anything the model does that cannot be undone, the decision to allow it belongs outside the model.