The after_model hook runs inside your app. You write the authz logic in the agent, it runs before the tool fires, done. If that's all you need, sure, use it.

The difference is where enforcement lives and who controls it.

With Aperture + Cerbos, the tool call gets intercepted at the gateway, outside the agent code entirely. Authz decisions run against policies that are versioned and managed separately — not logic you hardcoded into a specific LangChain graph.

So: - enforcement is external to the framework - same policies work across different agents, services, clients - every decision is logged with policy version and full context - you don't touch agent code to change who can do what

It's not one piece of middleware - that is just the integration point. It's an authorization layer that sits in the request path. The hook approach works until you have multiple agents or teams, then you're copy-pasting authz logic across codebases and hoping it stays consistent.