Enforcement: soft to hard gates

In preview

Injection makes the right decision available. Enforcement is what happens when the agent is about to do the wrong thing anyway. The idea is to intervene at the moment of action, through a pre-action gate, rather than catching the mistake in review after the change has already landed.

The adoption ramp

Enforcement is designed to earn trust before it takes control. It ramps through four rungs, and you move a rule along the ramp deliberately. Each rung is an attested ceiling: a rule takes the strongest action its ceiling allows and no more.

1. Observe. The gate watches the action and records it. It never changes the outcome. This is how a rule proves it fires on the right things and nothing else.
2. Warn (soft gate). The gate hands the agent a non-blocking advisory and lets the action through unchanged. The agent gets a heads-up to self-correct on its next step; nothing is stopped. Adoption without a hard stop, and no risk of a false-positive block.
3. Ask (confirm). The gate pauses the action and asks for confirmation before it proceeds. Stronger than a warning, short of an outright block.
4. Block (hard gate). The gate denies the action with a clear reason. Now the wrong thing cannot ship past it.

Observe before you warn, warn before you ask, ask before you block. A gate that blocks before it has proven itself is a gate your team will rip out. Blocking (and asking) is reserved for rules where the violation is mechanically certain; anything uncertain warns or observes, it never hard-blocks on a guess.

Where it stands today

Caution

Be clear-eyed about maturity. Three rungs are wired end to end; the broader interception layer is still observe-first, and prose guidance is injected, not enforced.

• A real deny exists. The notes-location rule is armed to DENY and can return an actual block on the wire when an action would violate it. Working proof that the hard gate is real, not theoretical.
• A real warn exists. A newly-armed forbidden-root rule defaults to the WARN ceiling: it permits the action and hands the agent a non-blocking advisory. This is the middle rung working end to end, so a rule can take action the moment it is armed without risking a false-positive block.
• Broader interception is observe-only. The general pre-action hook records what the agent is about to do and always passes it through unchanged. It is gathering the signal that later rules will act on; it does not warn or block today.
• Ambient prose is injected, not enforced. Most governed guidance has no mechanical action-time check, so it is placed in context for the agent to follow rather than gated. Only rules with a deterministic action predicate (today: forbidden-root path rules) can warn or block. We do not dress prose up as a gate.

One honest limit: a warning is delivered as model-facing context on the agent’s next turn, after the tool has run. It steers the next step; it does not rewind the action that just completed. That is the cost of being non-blocking, and it is deliberate.

That is the present state, and it is why this page is marked In preview. The seam is built, the observe / warn / block rungs each run end to end on real rules, and the rest is deliberately watching before it acts.

Why observe-first is the right default

Meetless Agent’s whole posture is “trust is the feature.” An enforcement layer that blocks confidently and wrongly is just a new way to be confidently incorrect, and a false-positive block is how a developer rips the gate out in week one. So enforcement starts by watching, adds a warning rung that takes action without ever stopping a call, and reserves the hard block for rules where the violation is mechanically certain. The connector page Asking & enforcing shows how the notes-location deny and the warn rung behave in a live session.