Everything on the decision path

Allow / ask / block before execution. Verified live on Kiro: a force-push to main was refused before it ran, a notice was delivered, and the session continued.

Read-only, in-workspace writes, and gated actions each get the right amount of scrutiny — with sensitive-path promotion (reads of ~/.ssh, ~/.aws, .env are promoted to gated).

Understands chains, pipes, subshells, backticks, interpreter one-liners, heredocs, base64 decode-and-execute, and data arguments — so obfuscation doesn't slip through.

An authorization envelope written in Cedar — the same policy language as Amazon Bedrock AgentCore Policy.

Deny-wins semantics, OGR continuation wording, and per-rule policy overrides fuse every signal into one disposition.

3 consecutive or 20 total denials escalate to the user, so a stuck agent can't grind against the gate.

Decide and record, never enforce — the default for new installs so you can watch before you block.

Per-category behavior applied locally by the hook when the daemon is down: closed for dangerous categories, open for everything else.

Open-weights (Apache-2.0), calibrated confidence, runs locally on Apple Silicon (MLX) or NVIDIA GPU — or on SageMaker for teams.

intent_authorized · exfil_risk · confirmation_given · injection_present · injection_targets_action — typed questions, not open prompts.

Sees user messages, prior-call summaries, and the structured action — never agent prose, tool output, or policy text. Structural injection defense by construction.

Configurable thresholds on judge answers map to allow / ask / block.

InvokeGuardrailChecks surfaces prompt injection, jailbreak attempts, and credential entities with character offsets.

The Decider and Guardrails are composed deny-wins, so either one can catch an injection the other misses.

pass · warn (additionalContext) · withhold (updatedToolOutput) — the probe can annotate or replace a result, not just flag it.

A consistency check that compares decisions with and without untrusted content to detect result-driven manipulation.

33 ms end-to-end. Block works; ask renders as block-with-notice. Verified live.

Real ask / deny / additionalContext / updatedToolOutput; merges into .claude/settings.json.

Shares the Claude-compatible shim; writes .codex/hooks.json.

InterventionHandler with Proceed / Deny / Confirm / Guide / Transform.

Middleware: wrap_tool_call plus interrupt() for human-in-the-loop.

defaults → user → workspace, validated and hashed onto every verdict.

Workspace roots, allowed remotes, allowed hosts, protected branches, protected paths, sensitive paths, and package indexes.

Change the action, enable/disable, or adjust the questions asked — rule by rule.

Run the policy against a corpus with interlock test before you ship a change.

fsync per record — the decision path never waits on the network.

TTL 90 days, PITR, stream, 3 GSIs, KMS encryption.

Drains the spool to DynamoDB with backoff, so offline operation just catches up later.

GSI3 surfaces asked / blocked / warned per day for review.

Streams → Firehose → S3 (Iceberg) → Athena.