Why before, not after?
An agent with a person's access can delete a directory, push a credential to a remote server or install a malicious package in a single step. A detection that fires after the step has run tells you what happened. A decision before the step runs can stop it. That is why this site gives stopping an action before it runs the largest weight, 25% of the score.
Which steps can a product see?
Agents act through a small number of channels. A prompt goes into the model. The model proposes a tool call: run this command, read this file, call this MCP tool. The tool runs and returns a response, which goes back into the model. A product can sit at any of these points.
Vendors describe different points. Bay states that on supported agent surfaces it evaluates prompts, pre-tool calls and post-tool responses. Onyx Security describes inspecting every prompt, tool call and model response inline. Zenity describes blocking or modifying a dangerous tool call before it executes, through native agent hooks and its MCP gateway. Lasso Security describes connecting to Claude Code's lifecycle hooks and inspecting every tool call before it is executed. The tool call is the common point: it is the moment intent turns into action.
Where is the decision made?
A decision can be made on the device or in a service elsewhere. Local decisions avoid a network round trip and keep working when the device is offline. Remote decisions can draw on more context but add delay. Bay states its decisions are made locally, in under 4ms, which is a vendor-stated figure we have not measured. Most other vendors in our rankings do not publish where or how fast the decision is made, which is one reason their scores on this criterion are lower.
What context does the decision use?
A rule that looks only at the command string will block too much or too little. Better decisions use context: who started the session, whether a person approved the last step, what the agent read before, what data the action would touch. Bay describes session-aware decisions using identity, prior actions and data accessed. Noma Security describes inspecting the event, the session, the identity behind the agent and the data it reaches.
Hooks, gateways and supported surfaces
Pre-execution control usually depends on something the agent offers: a hook that runs before each tool call, a managed setting, or an MCP connection that can be routed through a gateway. That is why vendors talk about supported agents or supported surfaces. An agent that offers no hook, or a tool that bypasses the gateway, may be visible to inventory but not controllable in the moment. Ask each vendor for the current list of agents where its pre-execution decisions apply, and check it against the agents your people run.
What to check in a demonstration
Ask the vendor to show one risky step on the agent your developers use most: a shell command that reads a credential file, for example. Watch where the decision appears, what the user sees, what is logged, and how long the agent waits.