Method + path + body matching is necessary but blind to provenance. GET /customers?limit=5000 looks identical whether the operator asked for it or a retrieved document did. The gateway sees a well-formed request that a policy permits what makes it an exfiltration is what entered the context window three steps earlier, and the egress boundary structurally cannot see that.
The approach we landed on binds the decision to the trajectory rather than the request: which retrieved content or tool result preceded this call, and whether any argument value originated in untrusted text. "This field traces back to a retrieved document" turns out to be a much stronger signal than any endpoint allowlist.
On testing them static policy unit tests pass trivially. What actually finds things is adversarial replay: take real traces, inject at the retrieval and tool-result boundaries, re-run, check the policy still holds. Multi-turn matters most, since single-turn injection suites miss the case where every individual step is permitted and only the sequence is the attack.
Response volume is the most under-implemented control on your list, and probably the cheapest one to add.