Change a rule. Watch the verdict change.
This is the same evaluation path the gateway runs. Flip the rule below and the verdict, the terminal output, and the recorded block all follow from it.
Request
- agent
- pr-triage
- action
- fs.read
- environment
- local
- origin
- developer prompt
Editable. Try ~/.aws/credentials.
Pipeline
- parse<0.02ms
- normalize<0.03ms
- secret detection<0.03ms
- risk classification<0.03ms
- policy evaluation<0.04ms
- approval check—
- sanitization—
- audit event<0.05ms
Secrets and risk resolve before policy — a rule may test risk >= HIGH, so the value has to exist first.
total<0.2ms
Decision
allow-workspace-read
Read inside the workspace root.
- read-only tool
- allow-workspace-readfs.read /workspace/*
- deny-dotenv-readfs.read **/.env*
- deny-credential-filesfs.read **/.aws/** ...
Permitted by allow-workspace-read. Forbid rules checked first.
#84921
sha‑256 566c…c1fd
prev 0000…0000
verified
Three views of
one decision.
The playground, the JSON output, and the system log are the same execution seen from three places. They cannot disagree.
Rule on — DENY
The action is refused before it runs. The caller gets the reason and the block number; it does not get the file.
Rule off — HOLD
Without an explicit allow, the execution is held for a human decision rather than passed through. Absence of a rule is not permission.
Either way, a block is written
A denied action and a held action both produce a record. The audit chain is not a log of successes.
Run this against your own policies
Start with the local control plane, then point it at your runtime.
Bring every agent
under control.
Set durable policy, preserve a verifiable record, and give teams a safer way to put intelligent systems to work.