The safety layer between your AI agent and your codebase.
Interlock hooks into the agent's tool-call path and checks every shell command, file write, and network action against deterministic safety rules, a scoped mandate, and a small local judgment model before it runs.
Works with Kiro · Claude Code · Codex · Strands Agents · LangGraph
Gates every tool call
Allow, ask, or block — before execution. The decision happens on the agent's tool-call path, not after the damage is done.
Probes tool results
Catches prompt injection and credential leaks in output, flipping dangerous results to warnings or withholding them.
Records everything
A tamper-evident audit trail — findings, probabilities, policy hash, timing — durable to DynamoDB before the response returns.
Local-first
Runs on your laptop and your AWS account. No third-party service sits in the loop and no data leaves your account.
Three steps on the critical path
Interlock sits inline between the agent and the action. Every gated call runs the same loop.
Agent proposes an action
A shell command, file edit, git push, network call, or MCP tool invocation arrives on the tool-call path.
Interlock decides
48 deterministic rules in 6 packs, a Cedar mandate, and a 2B decision model answer: allow, ask, or block — under 60 ms for the deterministic path, under 700 ms with the model.
The verdict is recorded
Findings, probabilities, policy hash, and timing are written to a durable local spool before the response returns, then drained to DynamoDB.
One daemon, one decision path
Harness adapters normalize every proposed action into a single event, then the daemon runs it through a deterministic engine, a local judge, and a result probe — composed deny-wins.
- 01Normalizerharness payload → InterlockEvent
- 02Tier Router0 · 1 · 2
- 03Deterministic Engine48 rules · 6 packs · Cedar
- 04State Projectorstructured · role-separated
- 05Strands Decider 2Blocal judge model
- 06Bedrock Guardrailsinjection · secrets probe
- 07Composerdeny-wins → verdict
- 08Audit Storespool → DynamoDB
Cheap actions stay cheap
Not every action deserves the full pipeline. Interlock routes by blast radius so reads cost a millisecond and only genuinely risky actions pay for the judge.
Put a gate in front of your agent.
Install for your harness, run the daemon in shadow mode, and watch every decision in a live log. Enforce when you're ready.