Six roles — and only some of them can stop anything.

A field of roles, not a stack of tiers

Two rules give the picture its shape, and they are the reason it is drawn this way. First, a role may be absent, and its absence is something the product reports rather than something another role quietly covers. Second, a role’s authority belongs to that role: the control plane decides but holds no traffic, transport mediation holds traffic and can refuse it, and today the Linux host adapter mostly watches. Nothing in the model makes them interchangeable.

What each one is, and what you get today

Which mechanism can actually stop something

Three different things get called protection, and telling them apart is most of an evaluation. Observed means an event reached the record. Evaluated means a decision was produced for the action. Denied before execution means the action did not take effect and the decision came first. Only the third is prevention — and the table below says which mechanism reaches it.

One inference this table exists to block. An audit event proves that something was observed. It never proves the action was stopped. A record and a refusal are different outcomes, and a page that treats one as evidence of the other is the failure this whole architecture was rewritten to prevent.

Where the platform changes the answer

Host-level adapting is the one role that is genuinely platform-specific, and it is where a picture drawn for one operating system misleads a reader running another. Each platform needs its own mechanism, and where a platform has none, it has none.

When an action is outside all of this

An action is on the governed path when, before it takes effect, it is presented to something that is configured to decide and to honour the answer. It is outside the boundary when any link in that chain is missing. These are the ways that happens today, each one measured rather than imagined.

• The agent never calls the checkpoint. The call is voluntary; a process that does not make it is not asking, and nothing about it is known.
• The answer is not honoured. The SDK evaluates and returns a decision; refusing to execute lives in the language shim around it, not in the client.
• Traffic never reaches the mediator. Proxy settings are injected by a managed launch — an ambient value, a removed one, or a session started by hand changes what is covered.
• The tool has no managed launch to offer. One shipped integration cannot build a governed launch command at all, and another is capped at observation, so neither injects anything to route.
• The destination is mediated but not inspected. Payload inspection is limited to model-provider hosts by default, so another host is tunnelled with its connection observed and its payload not.
• The encryption library is not one the probes hook. They attach to OpenSSL symbols, which Go’s own TLS stack and Node’s statically linked one do not expose.
• The platform has no host-level adapter — macOS and Windows, as above.

What gets recorded instead. For anything outside the boundary, nothing is known about the action, so the rule is that it is not reported as allowed and not as clean: the record says the action or its payload was not inspected. Read that as scoped to the action rather than to the connection carrying it — a host the proxy does not inspect is still adjudicated when the connection is made, so the connection is observed while the payload is not. One live defect runs against this rule today: the connection-level event still records an allow for traffic that is about to be tunnelled uninspected, tracked as AAASM-5637. Take the rule and the open defect together rather than as finished behaviour. And a quiet log is evidence about the observer, never about the agent.

This page stops here on purpose

Below this depth the answers live in the engineering record, where they are versioned with the code they describe. Each link goes to the source this page derives from — none of it is restated here, because a second copy drifts from the first inside one release.