From mandate to proof, at the last step before action.
Atbash doesn't watch the model think. It sits where a decision becomes a tool call, and decides whether that call may run.
amount: 25
to: new vendor
Each step leaves something you can check
State the job in plain words.
The same tool can be safe or dangerous depending on the job. The mandate is what every red line is measured against.
Map what it can reach.
A read-only scan reads tools, skills, plugins, memory and context files. It needs no enforcement permissions and changes nothing.
The ScannerOwn the rules. The agent never does.
Atbash proposes red lines from the gap between mandate and reach. Use them, adjust them or write your own. An agent cannot edit its own.
Decide before it runs.
The integration sends the action, its arguments and context. Atbash returns ALLOW, HOLD or BLOCK. On HOLD the agent pauses until a named approver answers.
VerdictsKeep proof that holds up later.
Each verdict is signed and kept off the agent's machine, with the reasoning and the red lines evaluated, so the decision can be reconstructed when the review begins.
EvidenceWhen something breaks, nothing runs by accident
Fail-closed
No verdict, no execution. A guard that can't be reached is a stop, not a pass.
Guard nodes
Uptime and verdict latency are monitored per node in the control plane.
Bring your own judge
Point Atbash at your own judge endpoint and inference.
Telemetry off
Telemetry can be switched off with a single config file.