Safety and Guardrails
Agents propose; people decide. Here is exactly where that line is, and what the emergency stop does.
Maturity: Beta overall. The approval gate and human-only decisions are enforced in code. Approval policies and multi-channel notifications are Experimental. Read from QuoxCORE 1b8bf54d.
| At a glance | |
|---|---|
| What it is | The controls that stop an agent acting on your systems without a person saying yes, plus the record of what happened. |
| Where it runs | In the collector on your QuoxCORE server, before every tool call. |
| When to reach for it | Before you let agents touch real machines, and when you need to show what they did. |
| How to start | quox approvals list to see what is waiting for you; quox safety status for the current safety level. |
What needs your approval
Tools that change things are sent to you as a proposal instead of running. This is enforced for, among others:
- shell and SSH commands that are not on the read-only list (
ssh_exec,remote_ssh) - database queries (
db_query) - virtual machine actions and deployments
- system administration, backups, alerts, email and notifications
Integrations and policies can mark more tools as needing approval. If the approval check cannot reach a service it depends on, it fails closed: the action does not run.
What runs without a proposal, so you know exactly where the line is:
- read-only commands on the allowed list (they change nothing);
- an action you asked for directly yourself, in chat or the CLI: your request is the approval;
- actions covered by a standing grant an admin created.
How an approval works
- The agent proposes the action. It appears in your inbox with the exact command and target.
- A person approves or rejects it.
- On approval, exactly that input runs. The approval is bound to a fingerprint of the input, the tool and the organisation, so a changed command is refused, not run.
- Every decision is recorded (see Evidence below).
Approvals can be escalated if nobody answers in time.
Only people can approve
Agents cannot approve anything. They can only file proposals. Items raised by an agent, and high-risk items, also need a step-up PIN from the person approving. Approving is an admin action.
Safety levels and the emergency stop
The safety level is one setting for your whole organisation, not a rating on each action.
| Level | What it does |
|---|---|
| GREEN, BLUE, AMBER | No extra gating. Normal approval rules apply. |
| ORANGE | Work agents start on their own, such as schedules and objectives, goes to a person for approval instead of running. Loops already running continue. |
| RED | Stops new autonomous work. Running loops stop at their next turn. |
The emergency stop button sets RED. It is admin-only, takes two clicks to confirm, and Resume returns to GREEN. It does not interrupt a single tool call that is already running; it stops the next one. A single-use override exists for a person who must act while RED is set.
quox safety status
quox safety estop <agentId> # admin: stop one agent
quox safety release <agentId> # admin
Command guardrails on the Bastion approval route
When a command goes through QuoxBastion's approval route, some commands are refused outright: wiping the root filesystem, raw disk writes (dd, mkfs), fork bombs and flushing the firewall. Others, such as recursive chmod 777, shutdown and reboot, always need approval. Agent SSH elsewhere uses the read-only list plus approval, not a command classifier.
Evidence
Approval decisions are written as signed, hash-chained events and witnessed into WARD, an append-only chain where every entry carries the hash of the one before. Governed agent actions are recorded the same way. You can download and check evidence yourself. See Evidence spine and WARD.
Organisation isolation
Each organisation's data is kept separate, and this is checked by live cross-organisation tests. See the security page.
Limits
- Read-only commands and your own direct requests run without a proposal. That is by design; it is stated above so the boundary is clear.
- No two-person approval for individual actions. One authorised person decides each action.
- No dry-run preview, pre-flight or post-flight checks, or automatic rollback are enforced today.
- Fleet changes are not staged in enforced waves. The planner prefers a small first batch, but nothing enforces it.
- Approval policies and approve-from-phone notifications are Experimental. Notifications tell you an item is waiting; you decide in Quox.
- The emergency stop does not cut off an action already running.
- "Every governed action" is the evidence scope. Some activity, such as terminal session detail, is recorded differently.
Related
- Introduction: approvals, safety levels and evidence in plain words.
- Architecture: where the governance check sits in a request.
- Agents: who proposes the actions.
- Evidence spine: how records become verifiable.
Last verified 2026-10-29 against QuoxCORE 1b8bf54d (code) and the status records.