Gate every tool call in the auto-memory extract agent so only safe read-only actions and targeted writes execute.