Solution · For security teams
Your engineers' agents already have a shell. The gateway checks each call, not the model.
Protect checks each tool call on the gateway, outside the model, before your agent runs it. A blocked call never reaches the shell, and the model only reads why.
The agent hides the file name inside a substitution.
Read as cat .env. The rule matches what the call does, not its text.
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Read environment files. .env files hold secrets.A Codex build sends its shell as a list of words.
{ "name": "local_shell",
"input": { "action": { "type": "exec",
"command": ["bash", "-lc", "cat .env"] } } }Protect finds a shell by the shape of its input, not by its name.
You want to see a rule at work before it blocks.
aws s3 rm s3://backups --recursive
The call runs. The log records "would block".
Balanced puts this rule in Monitor. Locked down blocks it.
A key on a laptop tries to turn Protect off.
API key: turn Protect off 403
An API key can only tighten the policy. To loosen it, a person signs in and gives a reason.
An auditor asks what the agents tried.
In each row
- time, decision, mode
- rule, type, tool
- program, host, path
- project, session, policy version
Never in a row
- command text
- flag values
- environment values
- file contents
Export as CSV or JSON Lines.
A rule inside the prompt is a request. A rule outside it is a control.
In one session an agent can read a .env file, push to main or run rm -rf ~.
Agents name their shells in many ways and hide one command inside another, such as cat $(echo .env).
Client permissions live on each machine. You cannot see in one place what agents tried, or prove what was stopped.
Watch first. Then block.
- 01Keep every call on the gateway
Rules run on the gateway, outside the model, so the model cannot change or skip them. For Claude Code, pin the base URL in managed settings. Codex cannot be pinned this way yet; see the limits.
- 02Run rules in Monitor
A rule in Monitor lets the call run and logs "would block". Activity lists programs, sites and tool servers no rule covers yet.
- 03Keep the audit trail
Each block goes into the decision log, with no command text. Each rule change goes into a hash-chained History. Export both for your auditor.
Tested by trying to get past it. On production.
No refused call had a side effect. The test run and its findings →
Every decision recorded. Every change in a hash chain.
| Control | What Protect does |
|---|---|
| Where it decides | On the gateway, before your agent runs the call |
| How a rule matches | By what a call does, not its text: a command wrapped in xargs, ssh or another wrapper meets the same rule |
| Who can loosen it | A person signed in to the console, with a reason. An API key can only tighten it. |
| Org policy | On Team, one policy for the org that agents cannot loosen |
| Decision log | Time, rule, tool, program, host and path. No command text, flag values or file contents. Export as CSV or JSON Lines. |
| Policy history | Who, how and why for every change, in a hash chain. An edited or deleted entry breaks it. |
Limits: Protect reads the call, not the program, so a script file or a compiled program gets past it. Keep the client sandbox on too. All limits →
What this uses.
Core protections, presets, packs, Sites and your own rules, checked on every tool call.
Every rule type, the decision log, history and each limit. See how to keep the gateway on.
One org policy, or your own gateway: a dedicated instance or your own Cloudflare account.
Protect is in every plan, Free included. It is off until you turn it on.
Related: Secure coding agents · For the enterprise · For platform teams
One policy for every agent. Held where the model cannot reach it.
npx @context-mode/cli connects your agents. 1,000 requests free, no card.