The firewall piece is the one an agent can't skip. A model judging whether the model's own inputs contain a planted instruction is the only pattern that scales with the volume — no human in the loop, no prompt written to taste. 89% catch at 3.5% false positives is the right shape of tradeoff, and input-token-only pricing quietly forces the questions to stay short and typed. What does the model get trained on for those two questions?