How a decision-first model can catch risky tool calls before they turn into real-world actions