What Writ does

Writ gives an existing agent a decision point and a project record. You do not need to move work into another chat or editor.

Level	Writ does	Use it when
Basic	Records visible tool calls. It blocks nothing.	You need to see which tools the agent uses.
Normal	Allows selected tools. It stops other calls for approval.	You know which tools the project needs.
Advanced	Applies enforceable writ clauses to the connected agent.	You need a path, command, domain, or exact-tool grant.

Basic: see the calls

writ connect codex

Writ installs a native user hook. The hook reports tool requests and results. Writ stores the project record under ~/.writ/projects/. No writ file or model key is needed.

Review the latest run after the first tool call:

writ review

Normal: set one tool limit

Allow normalized read and search tools:

writ connect codex --read-only

Or name exact agent tools or normalized tools:

writ connect codex --allow read --allow search

Writ stops a call outside the limit before the agent runs it. The call creates an approval request. Approval is bound to its tool name and arguments.

writ approvals
writ approve <request-id>

The limit applies to the user connection. Add --project to any connect, status, or disconnect command when the limit should apply only to the current project. When both connections exist, Writ applies both limits.

Advanced: apply exact authority to one session

A writ file states the outcome, allowed actions, budgets, protected files, and completion checks. Check which clauses the selected hook can enforce. Then apply the writ to the agent that you already use.

writ check task.yaml --explain
writ plan task.yaml --agent claude
writ sessions --agent claude
writ start task.yaml --agent claude --session <session-id>
# Continue in the selected Claude session.
writ finish --agent claude
writ review task-name

Make one complete tool call in the intended session before you run writ sessions. writ start does not launch an agent. It applies the writ only to the session that --session selects. Other sessions keep their normal connection policy.

Your existing workflow still gives the task to the agent. Writ records the mandate, but the native hook does not insert it into the agent prompt.

Run writ finish --agent claude only when you accept satisfaction. This command writes a human satisfaction attestation. Use --cancel to stop the attached writ without an attestation.

The plan lists every authored clause. A full native plan also lists /grants. That row proves that default denial covers the complete agent tool surface. An unsupported entry names the missing event or evidence. Writ does not activate the file when any entry is unsupported.

An omitted bound is authored-unbounded. The managed adapter adds operational defaults when you use writ issue. The /grants row and every authored clause must be enforced before native attachment.

Do not put secrets in a writ document or a placeholder value. Attached activation state stores the bound document.

Use writ issue only when you want Writ to run the model loop and managed tools. That adapter supplies model usage, verified worktree effects, and completion events that a native hook may not supply.

Know the boundary

A connected agent owns tool execution. Writ can decide a pre-tool event and record the result event that the agent reports. It cannot prove a side effect that the event does not show.

A normal tool-call entry stores normalized arguments and a digest of exact provider arguments. Exact provider arguments stay transient unless Writ creates an approval request. The approval request can store them after redaction.

Coverage also differs by agent:

Agent	Built-in tools	Local MCP	Remote MCP	Hosted tools
Claude	Covered	Covered	Covered	WebSearch and WebFetch are covered.
Codex	Most local tools	Covered	Covered	Hosted tools such as WebSearch are not visible.
Cursor	Covered in trusted workspaces	Covered	Covered	Early cloud turns can run before hooks load.
OpenCode	Permissioned tools	Covered	Covered	Coverage depends on permission events.

Run writ connect status <agent> to see the boundary for the installed connection.

Other boundaries

Use writ proxy when Writ must act as the MCP server for a client and connect to a local or remote MCP server. Use writ gate when Writ must observe model API traffic. The gate does not enforce tools. Use writ issue when the plan requires the managed model-loop adapter.