Architecture

Three layers. One verdict path.

An agent action is decided before it reaches your tools, enforced on the host, and optionally denied at the OS level. Fail-closed if a layer cannot decide.

verdict pathfail-closed
Agent
Intent to execute
01
Policy layer
Every action is evaluated against policy before it reaches your tools.
02
Host enforcement
The verdict is applied on the machine where the action would run.
03
OS layer (optional)
An additional deny point below the shell, for teams that want it.
Production
Runs only after a verdict

If any layer cannot decide, the action does not run. The OS layer is optional; the first two are not.

Policy layer

Every action is evaluated against policy before it reaches your tools.

Nothing proceeds without a verdict.

Host enforcement

The verdict is applied on the machine where the action would run.

Not reconstructed afterwards from logs.

OS layer — optional

An additional deny point below the shell, for teams that want it.

Not a claim of zero bypass.