Claude Haiku 5.5 acting as a tool-using agent through its public API. Before each action runs, a monitor reads only what any deployment can see (the agent's instructions, the task, earlier tool results and the proposed action) and decides whether to escalate it. The monitor was trained only on a different, open agent's labelled traces and never saw Claude. Below are real episodes; you can see what each monitor decided and what happened.