LLM-enabled customer-service software in financial institutions must choose a downstream service before responding. Classifiers and LLM routers can identify a relevant label or destination, but a composed application must still verify dispatch permission and entity registration. We study this integration problem as boundary-aware pre-response routing. We present RouteBR, a controller in which one model call proposes a primary service action and registered object, then deterministic code checks identifiers and versioned rules before dispatch or a specified non-dispatch outcome. Lower-ranked candidates cannot replace a blocked primary route. We construct 600 privacy-preserving scenarios from recurring confidential-request patterns at a real financial institution; three engineers jointly reviewed the scenarios and labels. On the 200-case CONFIRM MAIN split, RouteBR reaches 97.5% final-path exact match. A matched one-call baseline given the same rules reaches 95.5%, whereas a diagnostic baseline without the rule program obtains 94.0% action accuracy but only 41.0% final-path exact match. Across 166 non-dispatch MAIN and FLIP cases, RouteBR produces no false dispatch. The artifact pairs all 1,960 prediction rows with raw receipts while excluding gold and reviewer fields from model requests. These results support separating model proposals from code-owned, replayable execution. Our implementation is available at https://github.com/YgcCoder/RouteBR.
Large language model agents increasingly take consequential actions in digital and physical environments, where safety risks may emerge only after multiple interaction steps. This has motivated world-model-driven predictive safety guardrails, which anticipate future consequences before execution. However, existing evaluations largely focus on end-to-end safety outcomes, leaving unclear whether safety gains arise from reliable prediction and faithful use of predicted risks. In this work, we systematically diagnose the prediction-to-action pipeline along three dimensions: how world-model predictions are integrated into decision making, whether the predictions themselves are reliable, and whether their content is faithfully used. Across seven policy models and two safety environments, we find that stronger prediction involvement does not yield monotonic safety gains and can reduce task completion while substantially increasing inference cost. We further find that world-model predictions remain insufficiently reliable, especially over longer horizons, where safety prediction degrades substantially relative to near-term forecasting. Finally, we find that safety gains can persist even under corrupted predictions, while locally verified predictions still leave subsequent safety violations, showing that predictive content is not faithfully incorporated into the decision process. Together, these findings expose a fundamental prediction-to-action gap in current predictive guardrails: producing more or seemingly accurate foresight is insufficient unless that foresight is both reliable and faithfully translated into safer decisions.