Ready-made rules for the five agents everyone runs
A persona is a named policy at the level you already think — “an unattended agent that can’t rewrite its own memory or touch the shell.” Pick one and it starts in shadow: it replays your own last week of real calls and shows every call it would have denied. Nothing blocks until you click enforce, and enforce shows its diff first.
Try it before you trust it
Assigning a persona never starts with enforcement. It starts with evidence from your own traffic:
1 · Pick a persona
Five named policies, each one sentence of intent compiled into per-tool rules. Assignment is one write — no rule authoring, nothing to maintain per agent.
2 · Preview against your last week
The preview replays your own recorded calls — the last 7 days by default, up to 90 — through the same evaluator that enforces. You see exactly which calls it would have denied or paused, with the stated reason on each. The preview can't disagree with enforcement, because it is enforcement, pointed backwards.
3 · Enforce when you click
In shadow, nothing blocks — would-have-denied calls accrue in the trail while the agent works. One click flips to enforce, and the click shows you the diff of what changes before it acts.
One persona holds across Claude Code, Codex, dsh, opencode, and Hermes-class harnesses — the gateway resolves each harness's tool names into one vocabulary, so a fence you set once binds in every dialect. Each persona also states what it honestly does not cover; those lines are on the cards below.
Fenced Worker
Runs unattended. Works freely — can’t rewrite its own memory, touch the shell, schedule itself, delegate, or read credentials. The fences bind when nobody is watching; attended work proceeds untouched.
| Attended | Unattended | |
|---|---|---|
| Allows | Everything, logged | The work — reads, writes, web, connector calls (rate-limited) |
| Pauses | Nothing | Nothing — nobody is there to answer |
| Denies | Nothing | Rewriting its own memory · the shell · scheduling itself · delegating · changing its own skills · reading credentials |
| On the trail | Every call logged | Every call logged, PII redacted both directions |
Not covered: the fences bind to the agent’s reported tier — unattended rules depend on truthful tier labels. Work tools stay allowed at every tier.
Flight Recorder
Blocks nothing. Records everything — every call in the trail, PII redacted. The day-zero posture for an agent you want to understand before you constrain.
| Attended | Unattended | |
|---|---|---|
| Allows | Everything | Everything |
| Pauses | Nothing | Nothing |
| Denies | Nothing | Nothing |
| On the trail | Every call logged, PII redacted from inputs and outputs | |
Not covered: blocking — by design. Even in enforce mode this persona only records and redacts.
Coding Copilot
Codes beside you. Pauses before file deletes and credential reads; a command that reads a secret and sends it out is denied. The ask list is short on purpose — each pause means something.
| Attended | Unattended | |
|---|---|---|
| Allows | The work — reads, edits, builds, tests, the ordinary shell. Logged. | |
| Pauses | File deletes (your yes holds for 15 minutes) · reads of .env and credential files | |
| Denies | A command that reads a secret and sends it out — caught per call, on the real command text | |
| On the trail | Every call logged | |
Not covered: force-push and other destructive git forms need per-command matching — the risk classifier and the hardline floor catch them per call, not this persona’s static rules.
Research Scout
Reads the world. Writes only inside its workspace — anything past that waits for your OK, and secrets never leave.
| Attended | Unattended | |
|---|---|---|
| Allows | Reads, search, web fetch · writes and edits inside the workspace (source, docs, tests) · read-shaped shell (cat, grep, ls) | |
| Pauses | Writes or edits outside the workspace · any shell beyond reads (curl can POST data out, so it waits too) | |
| Denies | Edits to .env or credential files · remote shells (ssh) · a secret in an outbound request | |
| On the trail | Every call logged, PII redacted both directions | |
Not covered: a per-domain fetch allowlist is yours to add on top — fetching sources is the job, so the web stays open here. “Inside the workspace” means the classified file families; a path the classifier doesn’t recognize pauses rather than passes.
Ops/Deploy Agent
Ships things. Every deploy and infra change waits for a yes — attended included. The approval is the deploy review.
| Attended | Unattended | |
|---|---|---|
| Allows | Everything else, logged | Everything else, logged with PII redacted, rate-limited |
| Pauses | gcloud · aws · azure · firebase · kubernetes · terraform · docker · systemctl · launchctl · rm | |
| Denies | Nothing outright — but a session that racks up denials tightens to asking instead of grinding on | |
| On the trail | Every call logged | Every call logged, PII redacted |
Not covered: spotting a prod-named target inside a command needs per-command matching — the risk classifier and the hardline floor catch the destructive class per call.
See what a persona would have denied last week
Pick one, replay it over your own recorded calls, and read the result before anything changes. Free for individuals, forever.