thought

Sidecar Mechanism

Sidecar is a lightweight LLM call, parallel to the main reasoning, acting as a gateway for every tool call: a dangerous operation will not execute until the Sidecar approves it. The key decision is that the Sidecar sees only the structured call data (tool name, parameters), not the free-text reasoning: otherwise, an attacker could manipulate the assessment via prompt injection. Difference from proposer-reviewer: Sidecar is real-time classification of structured data (handled by a lightweight model), while proposer-reviewer is a validation of justification before/after the operation.