An agent action is decided before it reaches your tools, enforced on the host, and optionally denied at the OS level. Fail-closed if a layer cannot decide.
If any layer cannot decide, the action does not run. The OS layer is optional; the first two are not.
Every action is evaluated against policy before it reaches your tools.
Nothing proceeds without a verdict.
The verdict is applied on the machine where the action would run.
Not reconstructed afterwards from logs.
An additional deny point below the shell, for teams that want it.
Not a claim of zero bypass.