We’re exploring a deployment pattern where the agent is intentionally restricted from making outbound calls — treating it like an ML model (text in, text out, no credentials, no network access). The serving layer owns all I/O and s2s calls; the agent declares what data it needs, and the serving layer fulfills it. To implement this with LangGraph Server, we’re using interrupt() for data fetches — but the contract feels wrong for this use case: interrupt() is indeterminate — a human may ne...