The registrar

The registrar is Writ’s decision point. It receives a normalized action, checks every active policy layer, records the checks, and returns allow or deny.

One action form

Agent hooks, the MCP proxy, and the embedded runtime convert visible tool requests into the same action fields:

• agent and session;
• source boundary;
• normalized tool name;
• provider tool name;
• normalized arguments;
• a transient copy of exact provider arguments when the hook supplies it;
• execution owner and coverage.

This lets one policy layer apply to built-in tools and MCP tools without pretending that every source has the same visibility.

The model gateway has a narrower boundary. It routes and records model API traffic. It does not convert tool definitions, tool calls, or tool results into enforceable actions.

All policy layers must allow

A project profile or writ applies first-party task rules. A configured signed organization policy adds an outer limit. The registrar requires every layer to allow the action.

organization policy ─┐
                     ├─ all allow → action can run
project policy ──────┘

A project can narrow an organization rule. It cannot widen one. An organization allow-list denial is final. An organization approval rule can be satisfied only by a matching human approval.

Connected mode

With writ connect, the agent owns execution. Writ decides a reported pre-tool event and records the reported result. Observe mode records the decision and allows the call. Enforce mode stops a call outside the active profile.

If enforcement cannot verify an active organization policy or write the record, it denies the action. Observe mode can fail open only when no organization policy requires enforcement.

Attached writ mode

With writ start, the agent still owns execution. Writ first checks every authored clause against the native hook’s capabilities. It does not create an activation when a clause is unsupported.

The user selects a recently observed agent session with --session. The writ applies only to this session. Other sessions keep their normal connection policy. The registrar adds the writ as a hard policy layer. A connection approval cannot widen a Writ denial.

A normal tool-call entry stores the normalized arguments. It stores only a digest of exact provider arguments. The exact provider arguments stay transient. They can enter the record only in an explicit approval request, after redaction.

Embedded mode

With writ issue, Writ owns the model loop and managed tools. The registrar can also apply path grants, shell-command grants, budgets, worktree invariants, obligations, and satisfaction checks. The managed adapter verifies worktree changes with private Git snapshots. Read the writ issue worktree boundary.

Coverage is part of the decision record

The action states who executes the tool and whether Writ observed intent, result, or effects. An allow decision means that the visible request passed the active rules. It does not prove an effect that lies outside that boundary.