The gate: it stops the host, not the agent
The 24 rules block agent tool calls. But what if an action never goes through a tool call?
Some actions are done by the host client itself in the background — for example silently uploading a workspace snapshot. It does not pass through the agent, so no set of tool-call rules can stop it. So we built a second layer.
How it works
| Layer | Stops | Mechanism |
|---|---|---|
| 24 rules | agent tool calls | PreToolUse hook, decides before the action |
| Gate (host-shield) | the host client itself | OS-level ACL denying writes to the host's upload staging path |
These are not a containment relation. The gate is not among the 24 rules,
and structurally cannot be: grep checkpoint|snapshot rules/default.json returns 0 hits.
Measured on this machine (2026-09-19, independent Windows forensics)
4 workspaces 4/4 had a host upload staging manifest
2.2 MB manifest in plaintext
conclusion: 4/4 already uploaded and accepted
What it can do, in one line
It cannot bring back what already left. It can stop the next one.
Four limits (all published, or it is inflation)
- Off by default. Before you enable it, the module does nothing.
- Windows only.
- Cost: rollback becomes unavailable while enabled.
- Never reads ciphertext. ACLs only.
Cite this page
Antinel AgentState. The gate — the layer that stops the host itself. https://antinel.com/en/agentstate/shield/ (accessed YYYY-MM-DD)
Antinel. (2026). The gate — the layer that stops the host itself. AgentState. https://antinel.com/en/agentstate/shield/
BibTeX
@misc{antinel_en_agentstate_shield,
title = {The gate — the layer that stops the host itself},
author = {{Antinel}},
year = {2026},
url = {https://antinel.com/en/agentstate/shield/},
note = {claim tier: measured}
}
Claim tier: measured 采集时刻：2026-09-19