Durable audit
Snapshot the actor, tool address, outcome, reason, and matched policy so a decision remains understandable after rules or the catalog change.
Policy decision records omit tool arguments completely.
Set the rules once. Decide every governed call.
Controller evaluates governed calls before they reach an upstream service. Unmatched calls are denied by default; policies can allow them, require a person, or block them.
Three possible outcomes
The host attaches the connection credential and invokes the adapter. Agent code still never receives the plaintext value.
- * Explicit automatic policy match
- * Imported tool default when configured as fallback
- * Recorded policy outcome before upstream execution
How matching resolves
Policies can match exact or wildcard addresses, integrations, connections, risk, actors, environments, and structured input conditions. When several rules match, Controller resolves them in a deterministic order.
| Order | Factor | Resolution |
|---|---|---|
| 1 | Priority | Higher configured priority wins |
| 2 | Specificity | Narrower matching scope wins |
| 3 | Safer effect | Block, then approval, then automatic execution |
Input rules support exact values, membership, containment, regular expressions, numeric comparisons, negative operators, and the full input object. Common string-obfuscation forms are normalized, but narrow structural allow rules remain the stronger control.
Controls around the decision
Credentials
Decrypt only while constructing an approved upstream request.
Scoped API keys
Grant read, execute, approve, or admin with expiration and revocation. Store only the token hash.
Outbound boundary
Reject embedded credentials and private or reserved destinations; revalidate redirects before following them.
Coding-agent hooks
Route native tools and non-Controller MCP calls from Codex, Claude Code, Cursor, OpenCode, and other supported clients through the same policy engine, failing closed without a valid decision.
Know the trust boundary
- * Hook posture detects stale or silent enrollment; it does not attest a device or prevent a user from bypassing the hook
- * Shell commands still execute locally with the coding agent's operating-system permissions; the hook can allow or block the call, but it does not sandbox the process
- * Operational execution and approval records can retain inputs and outputs, so database access and retention still matter
- * URL validation is one layer; production should still add proxy, firewall, or cloud egress policy
- * External calls that require approval are blocked because Controller cannot resume work owned by another client