← Policy gallery

default_deny_confirmed

agentic-governance safety pure_temporal agentic-aigovernancefix-ai-wgcapabilityrag-redtier-4

At Tier 4 a default-deny authorisation must be confirmed before any tool call.

Formula

G(ToolCall → P(default_deny_confirmed))

Why it matters

Tier 4 capability control: default-deny-not-confirmed is a Red halt. Continuous authorisation must be established before the agent may invoke tools.

Examples

passes default_deny_confirmed established before any ToolCall

fails ToolCall with no confirmed default-deny authority

Use it

ponens policies add default_deny_confirmed --into ./trace.json
ponens trace check ./trace.json