When an AI coding agent proposes an action – running a command, editing a file, staging a commit – the governance layer in Ethosure must produce a response. That response is always one of exactly four options. Not “maybe” or “it depends.” Four options, each with a precise meaning, each producing a specific outcome for the agent and a specific record in the evidence log.
This simplicity is intentional. A governance system with too many possible outcomes becomes hard to reason about, hard to audit, and hard to explain to a regulator. The four-disposition model gives you a complete, unambiguous vocabulary for describing what happened to every agent action.
The four dispositions
ALLOW
The proposed action is permitted as submitted. Policy evaluation found no applicable violations. The action proceeds without modification.
What gets recorded: the approval event, the policy bundle version in effect, a timestamp, and a record that no violations were found. “No violations” does not mean “not checked.” The evidence log captures the evaluation, not just the outcome.
TRANSFORM
The proposed action is not permitted in its original form, but a compliant or lower-risk version can be constructed automatically. The system rewrites the action, allows the rewritten version, and records both the original and the transformed form.
A common example: an agent proposes a Git command that is functionally correct but uses an unsafe flag. Rather than blocking outright, the system rewrites the command using the managed Git wrapper – which enforces policy-consistent behavior – and allows the rewritten version. The agent’s intent is fulfilled; the risky form never executes.
Transform is the disposition that makes governance feel less like a barrier and more like a guardrail. The work gets done; the unsafe path is closed.
ESCALATE
The action cannot be decided automatically. It requires a human reviewer. The action is held, the context is forwarded to a responsible party, and the agent waits or is informed to pause.
Escalation is appropriate when policy cannot determine the right outcome from the available facts – for example, when an edit touches a file that requires sign-off from a specific owner, or when an action falls into a risk category that the organization has decided must always have human review.
From an audit perspective, escalation events are particularly valuable. They document the moments where human judgment was explicitly required, and who provided it, and what the outcome was. That is a meaningful part of the evidence trail for regulators asking whether humans remained in the loop.
BLOCK
The action is denied. It will not execute. The agent receives a structured response that includes the policy ID that triggered the block, the engineering principle that policy belongs to, and specific guidance on how to fix the issue.
Blocking is not just an error message. In the coding-ethos project, a block produces:
- A SARIF finding (a structured, standardized record used by code-scanning tools and CI systems).
- An entry in the append-only JSONL event log.
- A specific suggestion aligned with the violated principle.
- A recommended remediation step the agent can follow.
The agent is not just told “no” – it is given a precise, actionable path to a “yes.”
The implicit fifth outcome: fail-closed
Technically there are four dispositions, but there is an important implicit fifth behavior: if policy evaluation cannot complete – because the command is malformed, because an unexpected condition arises – the result is BLOCK. There is no “allow on error” path. This fail-closed default means the four-disposition model always resolves; it never produces an undefined outcome.
How this maps to business needs
For an AI or engineering team: the four dispositions give developers and agents clear feedback. The action is allowed, it was rewritten into a safe form, it needs human sign-off, or it is blocked with a specific fix. No guessing.
For a security team: the four outcomes are complete. Every possible disposition produces a record. There is no category of action that can “slip through” without being classified. A post-incident review can reconstruct the exact sequence of decisions for any session.
For a compliance team: the four dispositions map cleanly onto control documentation. “Block” corresponds to a preventive control. “Escalate” corresponds to a detective/review control. “Transform” corresponds to a corrective control. “Allow” with evidence corresponds to a documented clearance. The vocabulary is compatible with how compliance frameworks like NIST AI RMF and ISO/IEC 42001 describe controls.
For an auditor: every action has a disposition, every disposition has a structured record, and every record includes the policy that drove the decision. “Show me everything that was blocked last month and why” is a query the evidence store can answer.
Why four, not more
The design choice to use exactly four dispositions rather than a richer taxonomy is deliberate. More dispositions would require more complex logic to determine which one applies, more complex documentation to explain to stakeholders, and more surface area for edge cases. The four cover the complete space of outcomes: approved as-is, approved with changes, deferred to humans, denied. Everything else is a detail of the evidence or the remediation path, not a fifth outcome.
This simplicity scales. Whether an organization has ten agents or ten thousand, the same four-outcome model applies. The policy expressions change; the disposition vocabulary does not.
