Armor scores each tool call against a set of rules plus a slice of the transcript, prioritizing user intent. If the user asked "Push our work", a (bash tool: git push) is allowed, while a dangerous command the user never asked for is flagged.