interlock
How It Decides

The decision pipeline, end to end

Every gated call runs the same thirteen steps. The deterministic prefix is bounded to single-digit milliseconds; the model and the probe run concurrently inside a strict budget.

13-step pipeline

1
Authenticate
Bearer token, size-check, assign event_id (ULID).
2
Normalize
Harness payload → InterlockEvent.
3
Ledger
Session, turn, counters.
4
Tier routing
Classify the action: tier 0 / 1 / 2.
5
Deterministic evaluation
Packs, mandate, budgets.
6
Policy compiler
Compile policy → typed questions.
7
State projector
Structured, bounded, role-separated context.
8
DecisionBackend
Strands Decider (local) or SageMaker.
9
Post-action probe
Bedrock Guardrails — parallel with step 8.
10
Flip test
If injection_present ≥ threshold.
11
Composer
Deny-wins → final disposition.
12
Spool append
fsync — durable before the verdict returns.
13
Return verdict
allow / ask / block, with findings.

Latency budget

< 10 ms
Steps 1–5 complete on a laptop before anything async starts.
600 ms
Steps 6–10 bounded by the backend timeout (default).
concurrent
Guardrails runs in parallel with the Decider, not after it.

Threat model

Assets protected

  • ▸Workspace
  • ▸Git history
  • ▸Credentials (~/.ssh, ~/.aws, .env)
  • ▸Shared infrastructure
  • ▸The agent's own configuration

Why actions turn dangerous

(Anthropic taxonomy)

  • Overeager behavior
    The agent acts beyond what it was authorized to do.
  • Honest mistakes
    A wrong assumption about blast radius.
  • Prompt injection
    Hostile instructions in file contents, web pages, shell output, or MCP results.
  • Misaligned model
    The model's objective diverges from the user's.

The defense

Refuse the action before it runs. The response is identical in all four cases — Interlock doesn't need to know why an action is dangerous to stop it.

Adversary model

  • untrustedTool results are attacker-controlled.
  • taintedAgent prose is attacker-influenced after reading hostile content.
  • trustedOnly user messages and structured tool calls are trusted inputs.