A computer-implemented architecture constrains agentic large language model systems with autonomous tool access, treating the AI agent as an untrusted adversarial entity. A privilege-separated tool-call interception layer, operating as an independent OS process above the LLM's privilege level, evaluates every tool call against a hierarchical constraint set comprising inviolable containment constraints and governance-modifiable operational constraints. A multi-step bypass detection module classifies tool calls into a five-phase taxonomy (reconnaissance, preparation, exploit, exfiltrate, persistence) and detects collectively dangerous sequences through phase transition analysis. A containment boundary integrity monitor at the highest privilege level continuously verifies environment configuration against a reference state. An adversarial audit system, architecturally undiscoverable by the LLM through separate namespace isolation and unidirectional write-only communication, records all actions in a hash-chained append-only ledger. An emergent capability detection module monitors tool-call distributions for divergence from safety evaluation-phase profiles, restricting unevaluated capabilities pending governance authorization.