A persona is a named policy at the level you already think — “an unattended agent that can’t rewrite its own memory or touch the shell.” Pick one and it starts in shadow: as your agents run, every call it would have denied or paused is marked in the transcript and on Activity, with the reason. Nothing blocks until you switch to enforce on the Policies page.
Assigning a persona never starts with enforcement. It starts with evidence from your own traffic:
Five named policies, each one sentence of intent compiled into per-tool rules. Assignment is one write — no rule authoring, nothing to maintain per agent.
Shadow runs the persona against your calls as they happen, through the same evaluator that enforces. Each call it would have denied or paused is marked in the agent transcript ([ACP shadow] That was <tool> — <why>) and on Activity, with the stated reason. Shadow can't disagree with enforcement, because it is enforcement, not yet switched on.
In shadow, nothing blocks — would-have-denied calls accrue in the trail while the agent works. Switch to enforce on the Policies page when the shadow notices look right.
One persona holds across Claude Code, Codex, dsh, opencode, and Hermes-class harnesses — the gateway resolves each harness's tool names into one vocabulary, so a fence you set once binds in every dialect. Each persona also states what it honestly does not cover; those lines are on the cards below.
Runs unattended. Works freely — can’t rewrite its own memory, touch the shell, schedule itself, delegate, or read credentials. The fences bind when nobody is watching; attended work proceeds untouched.
| Attended | Unattended | |
|---|---|---|
| Allows | Everything, logged | The work — reads, writes, web, connector calls (rate-limited) |
| Pauses | Nothing | Nothing — nobody is there to answer |
| Denies | Nothing | Rewriting its own memory · the shell · scheduling itself · delegating · changing its own skills · reading credentials |
| On the trail | Every call logged | Every call logged, PII detected both directions, redacted per policy |
Not covered: the fences bind to the agent’s reported tier — unattended rules depend on truthful tier labels. Work tools stay allowed at every tier.
Blocks nothing. Records everything — every call in the trail, PII detected, redacted per policy. The day-zero posture for an agent you want to understand before you constrain.
| Attended | Unattended | |
|---|---|---|
| Allows | Everything | Everything |
| Pauses | Nothing | Nothing |
| Denies | Nothing | Nothing |
| On the trail | Every call logged, PII detected from inputs and outputs, redacted per policy | |
Not covered: blocking — by design. Even in enforce mode this persona only records and redacts.
Codes beside you. Pauses before file deletes and credential reads; a command that reads a secret and sends it out is denied. The ask list is short on purpose — each pause means something.
| Attended | Unattended | |
|---|---|---|
| Allows | The work — reads, edits, builds, tests, the ordinary shell. Logged. | |
| Pauses | File deletes (your yes holds for 15 minutes) · reads of .env and credential files | |
| Denies | A command that reads a secret and sends it out — caught per call, on the real command text | |
| On the trail | Every call logged | |
Not covered: force-push and other destructive git forms need per-command matching — the risk classifier and the hardline floor catch them per call, not this persona’s static rules.
Reads the world. Writes only inside its workspace — anything past that waits for your OK, and secrets never leave.
| Attended | Unattended | |
|---|---|---|
| Allows | Reads, search, web fetch · writes and edits inside the workspace (source, docs, tests) · read-shaped shell (cat, grep, ls) | |
| Pauses | Writes or edits outside the workspace · any shell beyond reads (curl can POST data out, so it waits too) | |
| Denies | Edits to .env or credential files · remote shells (ssh) · a secret in an outbound request | |
| On the trail | Every call logged, PII detected both directions, redacted per policy | |
Not covered: a per-domain fetch allowlist is yours to add on top — fetching sources is the job, so the web stays open here. “Inside the workspace” means the classified file families; a path the classifier doesn’t recognize pauses rather than passes.
Ships things. Every deploy and infra change waits for a yes — attended included. The approval is the deploy review.
| Attended | Unattended | |
|---|---|---|
| Allows | Everything else, logged | Everything else, logged with PII detected, redacted per policy, rate-limited |
| Pauses | gcloud · aws · azure · firebase · kubernetes · terraform · docker · systemctl · launchctl · rm | |
| Denies | Nothing outright — but a session that racks up denials tightens to asking instead of grinding on | |
| On the trail | Every call logged | Every call logged, PII detected, redacted per policy |
Not covered: spotting a prod-named target inside a command needs per-command matching — the risk classifier and the hardline floor catch the destructive class per call.
Pick one, run your agents as usual, and read what it marks before anything changes. Free up to 5 agents.