Same request. Different ending.
A verdict is returned before the tool call runs, judged against the mandate and the red lines you set.
ALLOWinside the mandate
It runs. It's still recorded.
The call goes through untouched. The decision lands in the record anyway, so the full history stays complete.
HOLDconsequential
A named person decides.
The agent pauses and the request goes to the approval queue with the payload visible. It resumes only on an answer, and the answer is part of the record.
BLOCKpast a red line
It never executes.
The call stops at the boundary and the agent receives the reason. Nothing reaches the tool.
JAILtried to cross or weaken a red line
It doesn't get to ask twice.
The agent is contained server-side. It can't release itself; only an operator lets it out.
How a verdict is reached
Three inputs. One answer before execution.
mandateWhat the agent is for
red linesOperator-owned rules
judgeAtbash-managed, or your own
action + arguments + contextsend_bank_transfer
ALLOWHOLDBLOCK
matched RL-12 · unverified payeeEvery verdict, on the record
The hearing never happens. Neither does the leak.
HOLDPrivate media → external recipient. Approve?owner answered: no · ACC-…-4417
BLOCKcrm_export.csv → external domainagent jailed · ACC-…-4418
ALLOWWeekly pipeline summary → internal channelwithin mandate · ACC-…-4419
illustrative records