Useful for setting a broad authority boundary. Repeated prompts can still create fatigue.
Runtime Safety
Autonomy needs an independent safety boundary.
AI agents inherit the operator’s shell, filesystem and credentials. CodeMarine evaluates defined high-impact actions before execution on supported paths, then shows where that boundary ends.
Runtime evaluation is implemented. Proof-backed Guarded status, live canaries and the unified Protection Center are planned.
The trust problem
Permission prompts ask the wrong question.
A broad prompt asks whether an agent may use the shell. Runtime policy asks whether this exact operation matches a deterministic catastrophe rule. Those are different decisions.
A narrow, independent decision for a defined action on an observed surface.
Deterministic rule packs
Catastrophe has recognizable shapes.
The current evaluator covers nine operational rule packs. The UI should group them by the outcome a developer understands, not by implementation file.
Files and permissions
Recursive deletion, protected boundaries, permission changes and disk operations
Git history
Destructive clean, hard reset, branch deletion and force-push signals
Databases
Schema drops, object deletion, truncation and broad destructive mutation
Containers and Kubernetes
Pruning, volume removal, namespace deletion and broad resource removal
Cloud and infrastructure
High-impact resource deletion across cloud CLIs, Terraform and related tooling
Credentials and integrity
Secret source-to-sink signals, protection tampering and sensitive configuration access
TRUSTED CONTEXT
- Operation
- Delete resource
- Environment
- Production
- Blast radius
- Broad
- Reversible
- No checkpoint
- Privilege
- Elevated
POLICY RESULTBLOCK
Immutable catastrophe policy. The agent cannot approve its own exception.
Beyond command text
Reason about the operation and its authority.
A command string is only one signal. Strong production policy also needs trusted environment identity, resolved target scope, reversibility and the credentials being used.
Immutable blocksDisk boundaries, protection tampering and clear credential exfiltration
Production blocksDestructive data or infrastructure operations where target context is independently proven
Review requiredHigh-impact actions that need a safe human rerun or future signed approval
Warn or observeAmbiguous or reversible operations below the blocking threshold
Protection depth
The control must sit where the authority flows.
A laptop hook cannot govern a remote agent. A shell parser cannot see a native SDK call. CodeMarine expands coverage by placing policy at several real interception points.
Local host hooks
Evaluate supported shell and write events before the provider executes them.
MCP and API gateway
Inspect structured tool calls before forwarding them to databases, SaaS systems or internal APIs.
Scoped credentials
Give the agent short-lived authority for one approved operation instead of a standing production secret.
Remote and downstream policy
Use sidecars where possible, then reinforce the boundary through CI, SCM and cloud controls.
Protection Center
Make safety obvious without making the UI noisy.
The planned experience elevates Runtime Safety into the normal product view. It separates code findings, action prevention, after-effect detection and recovery.
Sound is an attention channel. It is not evidence that an action was blocked. Only a proof-backed host confirmation can support that claim.
Per-surface statusGuarded, Alerts only, Setup needed, Problem, Off or Not covered
Critical incidentPlain-language reason, agent attribution and a safe next step
Native notificationImmediate host feedback without exposing the raw command
Optional soundUser-controlled, rate-limited and reserved for eligible critical events
Coverage contract
Prevention, detection and recovery are different.
A file watcher can detect a resulting workspace change after it happens. It cannot prove that a database call or cloud deletion was prevented.
| Capability | Meaning | Current status |
|---|---|---|
| Prevention | An authoritative hook denies the action before execution. | Beta |
| Detection | Guardian observes an eligible resulting file change while the watcher is healthy. | Current |
| Recovery | A prior captured file state can be restored after mutation. | Planned |
| Native or remote action | An unmediated SDK, browser, desktop or hosted-agent action. | Not covered |
Runtime Safety evaluation
Test the boundary before you trust it.
CodeMarine is building proof-backed protection for teams that want agent autonomy without hiding the gaps.
