Solution · For security teams

# Your engineers' agents already have a shell. *The gateway checks each call, not the model.*

Protect checks each tool call on the gateway, outside the model, before your agent runs it. A blocked call never reaches the shell, and the model only reads why.

[Talk to sales](mailto:sales@context-mode.com) [Get started free](https://console.context-mode.com/login)

The agent tries

cat $(echo .env) Shell under another name Monitor API key Decision log

The agent hides the file name inside a substitution.

Blocked · never reaches your shell **Read environment files**

Read as cat .env. The rule matches what the call does, not its text.

```
context-mode Protect blocked this command, so it was NOT executed:
Blocked by your team's policy: Read environment files. .env files hold secrets.
```

A Codex build sends its shell as a list of words.

```
{ "name": "local_shell",
  "input": { "action": { "type": "exec",
    "command": ["bash", "-lc", "cat .env"] } } }
```

Blocked · never reaches your shell **Read environment files**

Protect finds a shell by the shape of its input, not by its name.

You want to see a rule at work before it blocks.

```
aws s3 rm s3://backups --recursive
```

Runs **Change cloud resources · monitor**

The call runs. The log records "would block".

Balanced puts this rule in Monitor. Locked down blocks it.

A key on a laptop tries to turn Protect off.

```
API key: turn Protect off
403
```

An API key can only tighten the policy. To loosen it, a person signs in and gives a reason.

An auditor asks what the agents tried.

In each row

- time, decision, mode
- rule, type, tool
- program, host, path
- project, session, policy version

Never in a row

- command text
- flag values
- environment values
- file contents

Export as CSV or JSON Lines.

The problem

## A rule inside the prompt is a request. *A rule outside it is a control.*

**The shell is already open**

In one session an agent can read a `.env` file, push to `main` or run `rm -rf ~`.

**Text checks are easy to get past**

Agents name their shells in many ways and hide one command inside another, such as `cat $(echo .env)`.

**Each laptop has its own rules**

Client permissions live on each machine. You cannot see in one place what agents tried, or prove what was stopped.

How it works

## Watch first. *Then block.*

1. 01 **Keep every call on the gateway** Rules run on the gateway, outside the model, so the model cannot change or skip them. For Claude Code, pin the base URL in managed settings. Codex cannot be pinned this way yet; [see the limits](https://context-mode.com/docs/protect#pin).
2. 02 **Run rules in Monitor** A rule in Monitor lets the call run and logs "would block". Activity lists programs, sites and tool servers no rule covers yet.
3. 03 **Keep the audit trail** Each block goes into the decision log, with no command text. Each rule change goes into a hash-chained History. Export both for your auditor.

The model asks for a tool call. Protect checks it on the gateway before the call goes back to your agent. The model cannot change the rule: it only reads the refusal.

Proof

## Tested by trying to get past it. *On production.*

**126 of 126** Protect API checks pass on production **42** of the 103 matrix cases are bypass attempts **25 and 22** live checks pass in real Claude Code and Codex sessions, 1 skip each **403** for an API key that tried to turn Protect off

No refused call had a side effect. [The test run and its findings →](https://context-mode.com/blog/protect-rules-for-coding-agents)

What you can show an auditor

## Every decision recorded. *Every change in a hash chain.*

| Control | What Protect does |
| --- | --- |
| Where it decides | On the gateway, before your agent runs the call |
| How a rule matches | By what a call does, not its text: a command wrapped in `xargs` , `ssh` or another wrapper meets the same rule |
| Who can loosen it | A person signed in to the console, with a reason. An API key can only tighten it. |
| Org policy | On Team, one policy for the org that agents cannot loosen |
| Decision log | Time, rule, tool, program, host and path. No command text, flag values or file contents. Export as CSV or JSON Lines. |
| Policy history | Who, how and why for every change, in a hash chain. An edited or deleted entry breaks it. |

Limits: Protect reads the call, not the program, so a script file or a compiled program gets past it. Keep the client sandbox on too. [All limits →](https://context-mode.com/docs/protect#limits)

Products used

## What this *uses.*

**[Protect](https://context-mode.com/protect)**

Core protections, presets, packs, Sites and your own rules, checked on every tool call.

**[Protect docs](https://context-mode.com/docs/protect)**

Every rule type, the decision log, history and each limit. See [how to keep the gateway on](https://context-mode.com/docs/protect#pin).

**[Team and Enterprise](https://context-mode.com/docs/plans-and-limits)**

One org policy, or your own gateway: a dedicated instance or your own Cloudflare account.

**[Pricing](https://context-mode.com/pricing)**

Protect is in every plan, Free included. It is off until you turn it on.

Related: [Secure coding agents](https://context-mode.com/solutions/secure-coding-agents) · [For the enterprise](https://context-mode.com/solutions/enterprise) · [For platform teams](https://context-mode.com/solutions/platform-teams)

## One policy for every agent. *Held where the model cannot reach it.*

*npx @context-mode/cli* connects your agents. 1,000 requests free, no card.

[Talk to sales →](mailto:sales@context-mode.com) [Get started free →](https://console.context-mode.com/login)