otaExecution governance for humans and AI agents.
Get startedGitHub

Reference

Safe Agent Execution and Refusal

Runner-enforced safe closures, refusal evidence, and canaries for agent execution.

operateplatform teamsintermediatestable2026-07-31

Recommended next

Execution ReceiptJSON OutputAgent safety article

The job

Use this surface when an AI agent should be able to execute only the repository's declared safe subset.

Ota checks the complete selected closure before execution. A safe task name is not enough if a dependency, aggregate member, or workflow-reachable task is unsafe.

  • ota run <task> --agent enforces the effective safe task closure
  • ota up --workflow <name> --agent applies the same boundary to workflow execution
  • ordinary human execution remains a separate lane; agent mode does not silently redefine every operator command
  • refusal happens before selected setup, provisioning, services, containers, hooks, or task bodies start

Declare the safe surface

Agent boundaryyaml
agent:  safe_tasks:    - verify  refusal_canaries:    - task: publish tasks:  verify:    command:      exe: pnpm      args: [test]    safe_for_agent: true   publish:    command:      exe: pnpm      args: [publish]    safe_for_agent: false
Run the allowed agent lanebash
ota run verify --agent
Observe direct refusal (expected non-zero)bash
ota run publish --agent
Test refusal as a passing canarybash
ota run publish --agent --expect-refusal

Refusal is a result, not a failed attempt

  • Ota resolves admission before starting the selected execution closure
  • machine output distinguishes refusal from attempted execution and carries the blocked lane and reason
  • admission-produced receipts remain runner-authored; an agent does not narrate its own compliance
  • --expect-refusal passes only when the real agent boundary refuses as expected and no selected task starts
  • a refusal canary that is accidentally admitted fails the gate instead of quietly becoming ordinary success

What this does not control

Ota enforces the boundary only when execution goes through Ota or a cooperating harness that consumes Ota's capability profile.

  • Ota cannot stop an unrestricted developer or agent from bypassing Ota with raw shell
  • a local runner is fast feedback; mandatory CI and sandbox chokepoints provide the non-optional organizational boundary
  • safe admission proves the declared closure was allowed, not that the maintainer's safety claim was correct or complete
  • use Contract-Claim Assurance when the question is whether observable evidence supports the declared claim