Operator guide · three minute read

See the blast radius. Restore an escalated agent.

The two commands an operator runs most, for the security team running Interpose day to day. scan shows what an agent could reach before you enforce. release restores an agent that was escalated.

$ interpose scan
walking payments-api · 2,318 files · read only

high    .env.production          credential pattern, root
high    config/aws.json          cloud config, key material
medium  scripts/deploy.sh        shell, touches infra
medium  src/auth/keys.ts         key material by name
low     src/**                   1,904 files

start policy from the high and medium rows
writes nothing unless you pass --save

Assess before you enforce.

interpose scan in a project root lists every file an agent could touch, scored by how sensitive each one looks by filename and path pattern. It does not read file contents, so it is a blast radius map, not a found secrets claim.

  • Read only. Writes nothing unless you pass --save. Add --path=../other-repo --format=json to point it elsewhere or pipe into tooling.
  • Safe by default. It refuses to walk a directory that is not a project root unless you pass --path or --force, so it never crawls a home directory by accident. Symlinks are skipped.
  • How to read it. High means two or more sensitivity rules matched, medium is one strong match, low is everything else. Tighten the forbid list from the high and medium rows before it matters.
$ interpose release --agent=payments-api-4f2
agent was quarantined after 5 violations
last stop: shell egress to paste.lol, 14:02:38

restored to normal
release written to the signed trail, entry 9
proposed: allow egress to api.stripe.com, this role, 7 days
waiting on security to approve or reject

Restore an escalated agent.

Repeated violations escalate an agent: normal, then restricted (the agent keeps working and every action is flagged for review), then quarantined (the agent is stopped until an operator releases it), at thresholds set in the policy. interpose release --agent=<id> returns it to normal. Run it from a separate terminal if the agent's own shell is blocked, so you are never locked out of the recovery path.

  • Soft stops release in one click. A developer can release a single blocked action and keep working. You do not have to be in the loop for those.
  • Hard rules stay locked. A credential read or another default floor deny is never released by a soft click. Those belong to the gate and stay there.
  • Every release is logged and expires. Interpose proposes a narrow exception for a person to approve. Nothing is applied on its own.

Prove what ran.

interpose --verify-audit
Re-walks the signed trail, checks every Ed25519 signature, and returns a single VALID or INVALID verdict you can hand to a reviewer. Add --agent=<id> to scope it.
interpose --show-audit
Prints the signed entries themselves, newest first. Paths and commands are redacted to shape by default, so a deny names the file that was reached, not its contents.

Claude Code is the only live integration. scan scores by filename and path pattern, never by reading contents. This page reflects the present shipped state and moves as the product ships.

The full command reference, the policy schema, and the trail format ship with the pilot. For the architecture, read the technical brief. Questions: [email protected] or [email protected].