Skip to content
Meetless Agent

Asking & enforcing

Available today

This page is the hands-on version of two concepts: Ask and Enforcement. Asking is generally available. Enforcement is in preview, and this page is honest about where the line is.

Ask from the terminal

mla ask answers a plain question from governed memory, with citations.

Terminal window
mla ask "can we use Redis here, and what is the current rate limit?"

It supports focused modes when you want a particular shape of answer:

Terminal window
mla ask "what is our canonical auth flow?" --mode canonical
mla ask "list the services we run"          --mode search
mla ask "how did the rate limit change?"    --mode compare

The default mode gives a direct answer; search enumerates; canonical returns the source-of-truth document; compare contrasts claims. All of them cite sources, and all of them abstain rather than invent when the corpus does not cover the question.

Ask from inside the agent

With the MCP server wired (see Install & activate), the agent can query the same governed memory mid-task. When it needs to know a decision, it retrieves and cites instead of guessing. Same corpus, same cited answers, same abstention behavior; the only difference is who is asking.

Preview what gets injected

You do not have to take injection on faith. Before you rely on it, you can inspect exactly which confirmed rules and decisions the connector will place in context, and check the current scan-cache state:

Terminal window
mla status     # is Meetless active here, and what is in the injected slice

Enforcement in practice In preview

Here is the honest state of the gate in a live session. Three rungs of the observe, warn, ask, block ramp are wired; a rule takes the strongest action its attested ceiling allows, never more.

  • The notes-location rule can block. It is armed to DENY and returns a real deny on the wire when an action would violate it. This is the working proof that a hard gate is real. Blocking is reserved for rules where the violation is mechanically certain; nothing gets blocked on a guess.
  • A newly-armed forbidden-root rule warns. When such a rule is armed, its default ceiling is WARN: the action is permitted, and a non-blocking advisory is handed back to the agent (and shown to you) so it can self-correct. A warning never stops a tool call. This is the middle rung that lets a rule take action without risking a false-positive block.
  • Everything else observes. The general pre-action hook records what the agent is about to do and passes it through unchanged. It is gathering signal, not acting.

Two limits worth stating plainly:

  • A warning lands on the agent’s next turn, not mid-action. The advisory is delivered as model-facing context after the tool runs, so it steers the next step; it does not rewind the one that just happened. That is the price of being non-blocking, and it is deliberate.
  • Ambient prose rules are injected, not enforced. The bulk of governed guidance has no mechanical action-time predicate, so it is placed in context for the agent to follow (see Preview what gets injected). Only rules with a deterministic action check (today: forbidden-root path rules) can warn or block. We do not pretend prose is a gate.

So today, enforcement in a Claude Code session means: one rule that actually stops the wrong action, newly-armed rules that warn without blocking, a broader layer that is still only watching, and a large body of guidance that is injected rather than enforced. That is the ramp in its early, deliberate stage: warn before block, certainty before either.

Measuring whether it helped

Governed memory is only worth it if it changes outcomes, so the connector records adoption locally:

Terminal window
mla stats       # usefulness dashboard from local events
mla adoption    # did the agent pull or cite the evidence we injected?

These read local event data. What leaves your machine is covered on the configuration & privacy page.