agent-gate release gate
A proposed agent action runs through classify, then staged-secret scan, then done-check. Dangerous or unproven work is blocked with a safe path. Clean, proven work is allowed.
Honest scope. The classifier is a block-list. A command that matches no rule CONTINUES (classifier.py, "no risk rule matched"). Fail-closed lives in the evidence path: an unknown change-type is blocked and a completion claim without recorded proof is blocked (donecheck.py). Preset 5 shows both behaviors, exactly as the code runs them.
Off by default. agent-gate is not auto-wired into Claude Code. It enforces nothing until you run
init --activate. Until then you or the agent run it on demand. That is a deliberate design choice.
Pick a proposed agent action
Gate stages
Decision log
What you just saw
What is live and what is planned
| Works now (LIVE) | Planned (NOT built yet) |
|---|---|
| before-action (classify a command) | session-start and session-close |
| verify (proofs, built-in secret scan, adapters) | preflight (discover repo state) |
| done-check (block unproven "done") | policy-lint (find rule conflicts) |
| init (hooks; preview unless activated) | Stop and SessionStart hook enforcement |
| subagent open and close (scoped leases) | full adoption-safety sidecars in init |
| doctor (handoff-drift check), hook (Claude Code bridge) |
Ported subset
Try a commit, inspect its policy decision and follow the evidence required to finish the work.
Source
agent-gate.toml (risk_rules, sensitive, evidence)
agent_gate/classifier.py · agent_gate/secretscan.py · agent_gate/donecheck.py · agent_gate/verify.py · agent_gate/cli.py (hook exit 2)
tests/: 54 passing, run 2026-08-20