Action gating

Before an agent executes a shell command, pushes to a branch, or calls an external write tool (Slack, Linear, GitHub, Stripe), your harness must decide whether to execute automatically, pause for human confirmation, or deny.

mouse-1 evaluates semantic safety and task alignment in ~40–100 ms so you can gate every tool call on the hot path without slowing down safe local commands.

Defense in depth: deterministic floor + mouse-1 judgment

Keep your deterministic regex or allowlist rules as an unbypassable floor, and combine them with mouse-1 judgments:

1. Deterministic deny floor: Hardcoded denies (such as reading .env secrets or force-pushing to main when forbidden by repo policy) always block in code without a network call.
2. Semantic alignment (mouse-1): Ask atomic noul and score questions over { task, user_constraints, proposed_action } to catch semantic violations—for example, running git push when the user said "just show me the diff first, don't push".

Request: atomic gating questions

Instead of asking a single vague question like "Is this safe?", decompose the gate into specific, auditable questions in one request:

{
  "model": "mouse-1",
  "state": {
    "task": "Clean temporary build artifacts and run unit tests.",
    "user_notes": "Do not push or modify git history.",
    "proposed_command": "git reset --hard HEAD~2 && git push --force origin main"
  },
  "questions": {
    "matches_task": {
      "type": "noul",
      "instructions": "Is `proposed_command` a reasonable step toward completing `task`?"
    },
    "violates_user_constraint": {
      "type": "noul",
      "instructions": "Does `proposed_command` violate any restriction stated in `task` or `user_notes`?"
    },
    "blast_radius": {
      "type": "score",
      "instructions": "What is the reversibility and impact of `proposed_command`?",
      "criteria": [
        "Read-only inspection or running local tests with no file changes",
        "Reversible local workspace edit or deleting temporary build cache files",
        "Irreversible local deletion, history rewrite, remote git push, or external service mutation"
      ]
    }
  }
}

Response

{
  "id": "dec_7e04c19a3b82d510",
  "object": "systemone.response",
  "model": "mouse-preview-2026-10-13",
  "answers": {
    "matches_task": {
      "type": "noul",
      "noul": 0.01,
      "mouse": { "calibrated": false, "p_top": 0.99, "abstain": null }
    },
    "violates_user_constraint": {
      "type": "noul",
      "noul": 0.99,
      "mouse": { "calibrated": false, "p_top": 0.99, "abstain": null }
    },
    "blast_radius": {
      "type": "score",
      "score": 1.98,
      "confidence": 0.97,
      "legend": {
        "0": "Read-only inspection or running local tests with no file changes",
        "1": "Reversible local workspace edit or deleting temporary build cache files",
        "2": "Irreversible local deletion, history rewrite, remote git push, or external service mutation"
      },
      "probabilities": { "0": 0.0, "1": 0.02, "2": 0.98 },
      "mouse": { "calibrated": false, "p_top": 0.98, "abstain": null }
    }
  },
  "usage": {
    "input_tokens": 124,
    "state_tokens": 30,
    "question_tokens": 65,
    "framing_tokens": 29,
    "image_tokens": 0,
    "cached_tokens": 0,
    "output_tokens": 0,
    "cost_usd": 0.0000124
  },
  "latency_ms": 36.8
}

Three-band gating policy in code

Map the answers to three deterministic outcomes (allow, require_approval, deny) scaled by blast_radius:

type GateVerdict = "allow" | "require_approval" | "deny";

export function evaluateGate(answers: {
  matches_task: { noul: number };
  violates_user_constraint: { noul: number };
  blast_radius: { score: number; confidence: number };
}): GateVerdict {
  // 1. Explicit constraint violation -> hard deny
  if (answers.violates_user_constraint.noul >= 0.5) {
    return "deny";
  }

  // 2. Irreversible / external mutation (level ~2) or uncertain blast radius -> require human approval
  if (answers.blast_radius.score >= 1.3 || answers.blast_radius.confidence < 0.5) {
    return "require_approval";
  }

  // 3. Local action that aligns with the user's task -> allow automatically
  if (answers.matches_task.noul >= 0.85) {
    return "allow";
  }

  // 4. Middle band -> ask human to confirm
  return "require_approval";
}

If POST /v1/systemone is unreachable or times out on an action gate, always fail closed to require_approval (never to allow).