Monitoring that reviews an action only after it executes cannot prevent an irreversible consequence of that action.
If a tool call has already sent a secret, transferred funds, or issued a physical instruction, a later alert may limit subsequent harm but cannot make the first consequence unoccur. This is why pre-execution approval matters for one-step irreversible risks. For slower threats, after-the-fact monitoring may still catch early steps and reduce later harm. The distinction depends on the threat's timing, not just the monitor's model quality.
Logical consequence of action timing; OpenAI's monitoring report: https://openai.com/index/how-we-monitor-internal-coding-agents-misalignment/ explicitly distinguishes current asynchronous alerts from proposed pre-execution blocking and notes potential value against extended threats. OpenAI's API monitoring documentation: https://developers.openai.com/api/docs/guides/safety-checks/misalignment-monitoring says its asynchronous monitoring cannot undo earlier actions.