How are you stopping agents from doing things they shouldn't in production?

Genuine question for people running agents with real tools (payments, CRMs, EHRs, databases). Once an agent can act, the risk isn't a bad answer, it's a bad action: a refund that's too large, a write to the wrong record, a tool it shouldn't touch. Most setups I see log everything and review after the fact. What are you doing? hard checks inside each tool function? a guardrails library? human approval for risky actions? nothing yet? Context: I'm building axonpush (disclosure: founder). It sits inline on OpenAI/Anthropic calls and can block a tool call by name or argument (like amount > 1000) before your app runs it. One honest caveat I ran into: that only works on non-streaming responses. With streaming, the tool call has already reached your app by the time the full call is known, so it can only be flagged after the fact. Curious whether people stream agent responses in prod, or turn streaming off for tool-heavy steps. What's the worst thing an agent has done in your prod?