Keep edits in scope.
Check whether a proposed file change belongs to the requested fix or touches a protected path.
USE CASE / ENGINEERING
Keep coding agents
inside the task.
When an assistant can edit files, run commands, and call connected tools, each action needs the context of the developer’s request and the steps already taken.
REPOSITORY SCOPETOOL ACTIONSTASK HISTORY
CODING TASK / 018POLICY ACTIVE
DEVELOPER REQUESTFix the failing test
PROPOSED TOOL ACTIONEdit deployment workflow
TASK-AWARE DECISIONBlock unrelated change
ILLUSTRATIVE POLICY EXAMPLE
WHERE THE BOUNDARY MATTERS
From code suggestion
to real action.
A coding agent can cross multiple boundaries
while completing one request.
Check commands before run.
Read the command’s meaning and arguments before shell or build actions execute.
Carry context into tool calls.
Evaluate a destination or MCP action using what the agent already read and did in this task.
EXAMPLE TEMPORAL POLICY
A read can change
what comes next.
An agent reads a credential file while working on a test. A later request to send repository content externally must be checked against that earlier read, even if another subagent makes the request.
IF THIS TASKRead a sensitive file
AND THENRequests an external send
POLICY DECISIONBlock before execution
APPLY IT TO YOUR WORKFLOW
Use the action checkpoint
you already control.
Bring the proposed action, task identity, and earlier steps to Arangate. Enforce the allow or block decision before the tool executes.
Illustrative integration model; platform-specific adapters are not implied.