Tool-calling LLM agents are vulnerable to indirect prompt injection: externally retrieved data can redirect tool calls without system-prompt access, and prompt-level defences leave three harm classes undefended (path traversal, user-guided exfiltration, high-frequency tool abuse). We present a Policy Enforcement Point (PEP) that intercepts at the tool-call boundary with declarative rules over a cross-step information-flow label system (source integrity, data sensitivity) and a synchronous SHA-256 hash-chained audit log. On a controlled dataset across four attack classes, the full system cuts the attack success rate (ASR) from 40.0% to 5.0% (deepseek-v4-pro, five repeats) versus 35.0% for the strongest prompt-only baseline; disabling cross-step label propagation raises the call-level false-negative rate by 26.4 points. The 30.0% task-level false-positive rate is dominated by by-design least-privilege capability-token denials, not rule false positives—an expanded 30-task benign set yields 0/30 rule false positives under scripted isolation. A conservative-DS mitigation (intent-taint) closes the constructed denied-read reconstruction blind-spot variant (ASR 100% to 0%) at no cost on standard workflows. The audit log detects all three tested tamper classes; the in-process enforcement overhead is sub-millisecond per call. Across four further backends, ASR drops under the full system, though LLaMA-3.3-70B retains 16.7% (a rule-coverage gap). A preliminary run over a real MCP stdio transport (an official filesystem server) shows the mechanism operates at a real boundary with a sub-millisecond execution-path increment. We frame these as mechanism-coverage evidence on a controlled benchmark, not a deployability claim for production MCP workloads. Code, data, and metrics are openly available in the replication repository.

Spam-filter scores are difficult to interpret when split construction, attack denominators, and candidate validity are not retained. We evaluate an auditable RMF-PC protocol using word and character TF-IDF views, structural cues, calibrated fusion, and an optional paraphrase-consistency gate. The protocol freezes data, fitting, attacks, predictions, and review decisions; separates deterministic L1 rewrites from human-adjudicated L2/L3 candidates; and keeps exact-deduplicated Track A distinct from group-near-deduplicated Track B. On Track A (seed 42), gated RMF-PC achieved clean F1 97.937%, L1 F1 98.117%, and L1 spam FNR 1.971% (11/558). Its FNR difference from linear SVM was -0.538 percentage points (exact McNemar p=0.5078; paired-bootstrap 95% interval -1.613 to +0.538), so superiority is unresolved. On Track B, the same comparison had a raw p=0.0215 but a Holm-adjusted p=0.0859, showing that cohort policy can affect an inferential conclusion. Two reviewers and adjudication retained 38 L2 and 55 L3 candidates; observed misses were 1/38 and 0/55. Enron and third-party Zenodo-curated TREC tracks show corpus sensitivity and fixed 5%/10% adaptation results. Findings are limited to the retained local protocols.