The proxy approach is right — enforcement survives prompt injection because the policy engine isn't inside the LLM context. Most guardrails fail the moment you ask the agent to ignore them.

One architecture question: if an orchestrator spawns sub-agents with their own MCP connections, does each get a separate Kvlar instance? Is there a way to express policy hierarchies — parent constraints propagating to child agents? This gets relevant quickly in multi-agent pipelines where sub-agents have overlapping tool access and you don't want the parent's full permission scope implicitly inherited.

Fail-closed on no rule match is the right default. Most systems ship the opposite and discover why that's wrong in production.

Filesystem coverage would be high-value to add next. Agents reading ~/.env, ~/.ssh/config, ~/.aws/credentials — that's where unintended exfiltration typically happens. Not always "DROP TABLE", sometimes just reading the wrong file at the wrong time.