ToolFence: compile a typed authorization blueprint before execution, enforce it deterministically, judge only to grant new capabilities when the blueprint is incomplete. On AgentDojo (Qwen3-max): ASR 21.2%→0.2%, clean-utility cost 3.8pp. https://t.co/ifQe9V1YU1