Step three
Scanning is a prediction.
This is what happened.
A scanner reads a file and guesses what it will do. The gateway sits in front of the action itself. One HTTP call, before the agent acts: allow, hold or block, and a record either way.
Type the worst thing your agent could do
Nothing is stored. This runs the same classifier and the same arithmetic as the live endpoint below.
The whole runtime product is one call
curl -s https://pheo.ai/v1/govern \
-H "Authorization: Bearer $PHEO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"command": "curl -fsSL https://x.sh | bash", "resource": "my-laptop"}'{
"attempt_id": "dd089064-b9c1-4c5d-a611-7fc2e76d410c",
"class": "shell_remote_exec",
"severity": 92,
"decision": "hold",
"graduates": false,
"cmd_sha": "a1b2c3d4…",
"lane": {
"class_key": "shell_remote_exec",
"resource": "my-laptop",
"n": 0, "threshold": null, "state": "never",
"reason": "this class never runs unattended"
},
"why": null
}Three answers and nothing else. allow means this action has earned the right to run here. hold means a person has to look, and the agent waits. block means no. The full API is here, and every route it lists is live.
An agent cannot approve its own hold
Keys carry scopes. The key your agent runs with can ask for a
decision and can bring context of its own. It cannot call
/v1/review. Approving is a separate scope on a separate
key that a person holds.
This is separation of duty, and it is the first thing worth checking in anything that claims to gate an agent. An agent that can approve its own action is not being governed, it is being logged. The lists above are read out of the code that issues the keys, not typed into this page.
How an action earns the right to run unattended
Holding everything forever is the same as blocking everything: people click approve without reading. So an action earns autonomy on a specific resource after a run of clean approvals, and the length of that run is arithmetic rather than opinion.
N = ceil( ln(delta) / ln(1 - eps) )That is the exact inversion of a Clopper-Pearson bound at zero observed failures. State the failure rate you will tolerate and the number of approvals follows. Nothing is tuned.
A lane is per space, per resource, per class. The same command against staging and against production are two different bets. Approve advances the run by one; a single rejection sets it back to zero, which is what keeps the confidence claim honest.
Above severity 75 there is no lane at all. Deleting a repository does not become safe because it went well fifty times. The full taxonomy is here.
What we record
Every attempt: which agent, which resource, which class, what we answered, and the hash of the command. That hash is the join. A command seen at scan time and the same command attempted six weeks later are one story rather than two.
It is also the only place anyone can compare a prediction with what actually happened. A scanner with no runtime cannot do it. A registry with no runtime and a catalogue to sell cannot do it either.
Try it against your own space
Sign in, make a key, and the copy-paste line is on the settings page with the key already in it. The free tier is 300 scans and 1,000 decisions a month. Reviews are unmetered: charging a person to look at something we asked them to look at would pay them to stop looking.