Guarding a support agent's tool calls: provenance, a customer's yes, written gates and a backend that teaches