Loading…
Concept
Agent Permission Scope
Usually because the credential was scoped for the routine case and nothing re-read it at the moment of the destructive one. A token wide enough to do the day job is wide enough to delete the volume. A static scope also cannot express “refund up to $200, escalate above” — it answers yes or no to a whole capability, once, in advance, which is the wrong place to put a limit that depends on the specific action.
Why did the agent have permission to do that?
Usually because the credential was scoped for the routine case and nothing re-read it at the moment of the destructive one. A token wide enough to do the day job is wide enough to delete the volume. A static scope also cannot express “refund up to $200, escalate above” — it answers yes or no to a whole capability, once, in advance, which is the wrong place to put a limit that depends on the specific action.
2 patterns answer this
Prevent destructive production changes
A command, script, or agent drops a table, deletes a bucket, or tears down infrastructure.
3 executable policies
Privileged access grant
An access request grants elevated or root scope to a person, contractor, or service.
6 executable policies
From this term to a governed action
- Prevent destructive production changesThe recurring action behind this term.
- Claude Code Destructive-Shell GateAn executable policy that implements it.
- Try to break it in the sandboxA real signed verdict, no account.
- Deploy on your surfaceAvailable on 2 platforms today.
- Verify the proof yourselfCheck the signature without trusting us.
- Start in Shadow ModeMeasure on your traffic before enforcing.
Where this fits
Decionis is the deterministic decision layer between intent and execution. This concept is one way in; the architecture behind it is the same in every case.