Real interceptions. Our own agents.
Every agent that builds this product runs under its control. That produces something no demo can: a running log of real interceptions — the agent that builds ACP getting held, denied, capped, and caught by the very controls it ships. Nothing below is staged or simulated; entries are added as they happen, most recent first.
Activity, filtered to Denied, in the workspace our own agents run in. Screenshots on this page are taken from that console, not staged.
Runs: one row per agent execution, with the findings the record produced.
The deploy agent got policy-checked by the thing it deployed
The agent that deployed calafia.ai’s release tried to curl the site to verify the deploy — and the control plane it had just deployed through denied the call: api-tier policy, Bash.curl.calafia.ai. It verified through a policy-permitted fetch instead. No exception for being the author.
The floor that caught its own author — twice in its first hour
An agent edited the launch wrapper that controls it — to restore the controls after a setup bug, which is exactly the point: the capability to rewrite control config is identical in both directions, and "it was a safety fix" is what a compromised agent would say too. Our classifier could detect this class; enforcement had never been wired. Same day it became an unconditional floor — above policy, unapprovable, direction-blind. Within an hour of going live, the floor denied its own author twice: first for blog copy mentioning the protected paths, then for the regression tests inside the precision fix. Both prose, both denied, both now encoded as tests. The most useful entries on this page are the miss — and the overcorrection.
The credential broker's first catch was its own author
The moment credential brokering went live on our dev machine, the very next gh command was denied — GitHub had never been OAuth-connected through ACP there. The agent declined to script around its own broker, handed the connect link to a human, and after one click the same command ran on the OAuth token ACP holds server-side. The local credential never left disk. (The deny also exposed a brand bug in the connect link itself — fixed the same hour.)
Mid-incident, the fix had to take the reviewed path
During a production incident, the agent tried to shift Cloud Run traffic directly to a hotfix revision. Policy denied the raw traffic surgery — so the fix went through the standard build-review-promote pipeline instead. Slower by ten minutes; auditable forever. The deny didn't block the fix. It blocked the shortcut.
The agent declined to raise its own spending cap
An ops agent's daily LLM budget fired mid-investigation — consumed by the very cost bug under investigation. The agent doing the investigating had admin access to raise the cap. It didn't: an agent lifting its own safety net is exactly what the control plane exists to prevent. Verification waited for the daily reset.
The surprise bill came from the one agent outside the plane
A ~$15/day model bill traced to a container running on a fresh API key — spend invisible because it never crossed the proxy. The same afternoon, the agent investigating it — inside the plane — couldn't delete its own scratch files without an approval card. The bill you get surprised by is always from the agent you didn't control.
The approval card received while building approval cards
While configuring controls for a new agent, the builder agent tried to clean up a one-off script with rm. The hook held the delete for human approval — during the very session that was setting up approvals for another agent. The agent building the cage got caged.
Approved, complied — and the grant expired between them
A human approved a held action; the agent retried outside the grant window; the system minted a second approval card for the identical action. Everyone did the right thing and the baton still dropped. Filed and fixed as a grant-delivery issue — approvals are a conversation, and conversations need delivery receipts.
The metric that manufactured work
A cost tool double-counted cache reads and reported a real ~96% cache-hit rate as ~50%. A founder and a frontier model nearly built a feature to fix a problem that didn't exist. Verifying the claim against raw run data killed it in an afternoon. Full write-up.
The anti-abuse guard doesn't know who the founder is
Creating an internal workspace through the canonical path hit the workspace cap — the guard stopped the product's own founder, who had to take the deliberate, authorized admin route instead. Guards that recognize VIPs aren't guards.
Four agents hit the rate floor at once
A research fleet — three subagents plus the main loop — tripped the per-key rate bucket, and the agents read the denial as a permissions failure and aborted. The floor held as designed; what shipped the same day was a calmer denial: sub-2-second waits absorbed server-side, and retry copy an agent can act on.
Want the other kind of proof? Everything above is unstaged — our own agents, caught live. For the industry’s worst real incidents — the ones that made the news — rebuilt in a sandbox and stopped by the same controls, see the Recreated series →
Why we publish this
Two reasons. First, honesty is cheaper than polish: these entries include our own bugs and process gaps, because a control plane you only hear good things about is a control plane nobody's using hard. Second, this is the product working as designed — deterministic allow/ask/deny on real actions, budgets that hold under pressure, metering that catches what dashboards miss. If you want the same controls on your own agents, start here. If you want the enforcement concept first, read what an agent firewall is.