The agent needs this permission to run the test suite.
Allowed for session CodeMarine Dev · Agent Runtime
Stop destructive agent actions before they run.
An agent using your shell can delete a repository, reset a database or tear down infrastructure in seconds. CodeMarine places a deterministic veto on supported execution paths so the model is not its own safety system.
CODEMARINECommand Guard
AGENT REQUESTClaude Code · local shell
PROPOSED ACTION
Reset the production payments database
Production targetIrreversibleBroad impact
POLICY DECISIONDENY
WHY IT STOPPEDKnown destructive database operation
The agent cannot approve its own exception.
Current scope: supported pre-execution hooks. Remote and unmediated actions require a separate control path.
The agent needs shell access. That does not make every command safe.
Shell access lets an agent run tests and ship code. It can also erase work, reset the wrong database or delete live infrastructure. CodeMarine checks the operation, not just the permission.
- “Reset the test database”The production connection is active.
- “Clean my branch”Uncommitted work will be erased.
- “Remove the preview stack”The production cloud account is selected.
CodeMarine checks the destructive operation itself.
The instruction sounds normal. The result can be catastrophic.
One bad path, wrong environment or broad command can turn routine work into an incident.
“Clear the build cache.”
A bad path resolves to your repository or home directory. A recursive delete can take source code, keys and local files with it.
CODEMARINE CHECK
Protected filesystem boundary“Get my branch back to clean.”
A hard reset or forced clean removes hours of uncommitted work, untracked files or an unmerged branch.
CODEMARINE CHECK
Hard reset · forced clean · unsafe push“Reset the test database.”
The active connection points at production. The agent drops the database, truncates live tables or flushes Redis.
CODEMARINE CHECK
DROP · TRUNCATE · FLUSHALL“Clean up old containers.”
A prune removes persistent volumes while a Kubernetes cleanup can delete a namespace and its production data.
CODEMARINE CHECK
Volume removal · broad cluster delete“Tear down the preview stack.”
The wrong cloud account or Terraform workspace is active. The cleanup terminates live resources instead.
CODEMARINE CHECK
Cloud deletion · infrastructure destroy“Use my credentials to investigate.”
An agent or poisoned tool reads environment files, cloud credentials or SSH keys and moves them toward an external endpoint.
CODEMARINE CHECK
Sensitive source · external destinationTRUSTED CONTEXT
- Operation
- Delete resource
- Environment
- Production
- Blast radius
- Broad
- Reversible
- No checkpoint
- Privilege
- Elevated
POLICY RESULTBLOCK
Immutable catastrophe policy. The agent cannot approve its own exception.
Reason about the operation and its authority.
A command string is only one signal. Strong production policy also needs trusted environment identity, resolved target scope, reversibility and the credentials being used.
Immutable blocksDisk boundaries, protection tampering and clear credential exfiltration
Production blocksDestructive data or infrastructure operations where target context is independently proven
Review requiredHigh-impact actions that need a safe human rerun or future signed approval
Warn or observeAmbiguous or reversible operations below the blocking threshold
The control must sit where the authority flows.
Local hooks protect local paths. Remote agents, APIs and cloud systems need their own enforcement points.
Local host hooks
Evaluate supported shell and write events before the provider executes them.
MCP and API gateway
Inspect structured tool calls before forwarding them to databases, SaaS systems or internal APIs.
Scoped credentials
Give the agent short-lived authority for one approved operation instead of a standing production secret.
Remote and downstream policy
Use sidecars where possible, then reinforce the boundary through CI, SCM and cloud controls.
Make safety obvious without making the UI noisy.
Agent Runtime belongs in the normal developer product view, with clear status, critical alerts and safe next steps.
Alerts draw attention. Only host proof confirms a block.
Per-surface statusGuarded, Alerts only, Setup needed, Problem, Off or Not covered
Critical incidentPlain-language reason, agent attribution and a safe next step
Native notificationImmediate host feedback without exposing the raw command
Optional soundUser-controlled, rate-limited and reserved for eligible critical events
Prevention, detection and recovery are different.
Seeing an effect after it happens is not proof that the action was stopped.
| Capability | Meaning | Current status |
|---|---|---|
| Prevention | An authoritative hook denies the action before execution. | Beta |
| Detection | Guardian observes an eligible resulting file change while the watcher is healthy. | Current |
| Recovery | A prior captured file state can be restored after mutation. | Planned |
| Native or remote action | An unmediated SDK, browser, desktop or hosted-agent action. | Not covered |
Test what your agents can actually reach.
Map the commands, targets and systems in scope, then put a narrow veto around operations that could cause irreversible damage.
