Use Gryph when a coding-agent session touched too much, failed unexpectedly, or needs a security review, and you want a local audit trail of file access, writes, and command execution. Invoke it instead of using the agent normally when the task is post-session review, querying, and export of agent actions across supported clients, not generic endpoint security or a broad agent platform. The boundary is the action-audit workflow itself: Gryph installs hooks, records events locally, and lets operators inspect what the agent did.