Enforcement
What each decision means, how one is reached, and where it is recorded.
Every action your assistant attempts resolves to exactly one outcome.
| Outcome | What happened | Where you see it |
|---|---|---|
| Allow | The call ran. | Allowed, on the session |
| Hold | The call paused for a human. | Held, and in your Inbox |
| Deny | The call was stopped. | Blocked, on the session |
| Error | The check itself could not complete. | Failed, on the session |
Policy Studio labels these Allow, Hold, and Block on its buttons. Session evidence labels them Allowed, Held, Blocked, and Failed.
The Policies table on a session detail carries a fifth count, Ask, tracked separately from Hold so that the per-policy counts reconcile against the call total.
How one is reached
A tool call is checked against your workspace policy before it runs. The most specific thing wins: a rule naming that tool takes precedence over the default for unmatched tools.
Policy evaluation is blocking, and it fails closed. If the check cannot complete, the call does not quietly proceed as an allow. It is recorded as an error, which is why Error is a real outcome you will occasionally see rather than a category that silently disappears.
Two enforcement points
The plugin on your machine enforces the profile you publish from Policy Studio. This is what stops a tool call before it runs.
The server holds policies that apply to agents and MCP servers, listed on the Policies screen with their own actions: block, hold, allow and log, alert, and quarantine.
They are separate. Publishing a profile in Policy Studio does not change a server-side policy, and the console does not pretend otherwise.
How a decision is tied to a call
On the session detail screen, each recorded call reports how confidently its policy decision could be matched to it:
- Linked on this span. The decision and the call are the same record. Strongest evidence.
- Linked by call id. Matched by identifier across records.
- No policy link. No decision evidence arrived for this call.
The third case means evidence is missing, not that the call was unguarded. The console reports the gap rather than filling it in, which is the same principle described in Telemetry.