Real-Time Enforcement
Decisions made before damage is done
Most systems track what happened after the fact. Modus enforces before it happens. Every agent action passes through the enforcement engine, which verifies identity, evaluates constraints, detects dangerous patterns, and renders a decision — all in under a millisecond.
Permit, Block, Suspend, or Hold
Permit
All checks passed. Action executes. Result returned.
Block
Constraint failed. Action does not execute. Agent receives error.
Suspend
Dangerous pattern detected or human approval required. Action held pending review. Has not executed.
Output-Hold
Action executes (it’s legitimate), but output withheld pending reviewer approval. Foundation of Supravision.
Every decision produces a signed attestation appended to the audit trail.
Sub-Millisecond Verification
Under 1ms. No network round-trips. Local verification against cached catalog snapshots. Built for thousands of calls per hour.
Real-Time Revocation
Every gate knows within milliseconds. Mid-task revocation blocks the next action. Cascading through delegation chains — revoke the parent, every child is invalidated.
Spend Enforcement at the Gate
Budget checked before execution. Not tracked after overages. If spending would exceed the limit, the action is blocked.
Dangerous Pattern Detection
Scans for recursive deletions, privilege escalation, unusual network destinations. Produces SUSPEND decisions for human review. Configurable per gate.
Approval Reuse
Human approves a suspended action and sets a reuse rule. Future identical actions auto-approve within the session. All other constraints (budgets, rates) still evaluate. Reduces approval fatigue.
No-Bypass Architecture
The enforcement gateway is the only path between agent and OS capabilities. Direct access blocked at the environment level. Agent cannot bypass the gate.
Related