The decision path

Every governed call moves through five stages: agent, intercept, authorize, broker, record. Nothing about Cirvix makes sense without this chain.

Cirvix is described as ten modules because ten is how many separately-named capabilities it takes to cover this path end to end. It is more useful to first see it as one chain that a single tool call walks, stage by stage.

Agent

The call originates from an agent with a verifiable identity: an owner, a runtime, and a scope. See the Agent Identity module.

Intercept

The call is decoded into a canonical form before anything else looks at it, so an encoded payload and a plain path are the same object to policy. See Runtime Security.

Authorize

The policy engine evaluates the call against the rule set and resolves it to permit, forbid, or a hold.

Broker

A permitted call is carried to its target — through the secrets boundary if it needs a credential, through an approval if it's held, through the MCP or A2A gateway if the target is a tool server or another agent.

Record

The decision is written to the audit chain — agent, action, resource, policy, verdict — whether the call was permitted, denied, or held.

Worked example

The pr-triage agent (agt_7Q2X9F, owner priya@example.com) is asked to summarize a pull request, reads a review-notes file, and — because the file contains injected instruction-like text — attempts to read .env.production next.

run_01JQ8F2K7M

00.000  agent      pr-triage plans a PR summary00.118  intercept  github.pull_request.read #4821 decoded, canonical00.118  authorize  permit  allow-workspace-read00.402  intercept  fs.read PR_review_notes.md decoded00.406  authorize  ⚠ injection score 0.91 on tool result — flagged, not blocking00.409  intercept  fs.read .env.production decoded00.409  authorize  deny  deny-dotenv-read00.409  broker     refusal returned to the agent — no filesystem call made00.409  record     dec_01JQ8F2K7M written to the audit chain00.411  agent      re-plans after the refusal, continues without the file

Run cirvix why dec_01JQ8F2K7M and every line above is one field of the same decision record — see The execution graph.

What is not on this path

Blind spots are structural, not incidental

Only calls that traverse an instrumented surface are on this path. A subprocess an agent spawns outside a wrapped runtime, or an MCP server configured directly instead of through the gateway, never reaches intercept — which is exactly what [cirvix scan](/docs/cli) exists to find on a running machine.

Agents & identityWhat travels with a call.PoliciesHow authorize actually decides.Secret handlesWhat the broker substitutes.ApprovalsWhat a hold looks like.The execution graphHow a run is reconstructed.Audit chainWhat gets written, and how it's proven intact.

Edit this page on GitHub

Was this page helpful?