Inline enforcement

There is one test, applied literally. Can the action reach its target without the decision being taken? If it can, by any route — a second credential, a direct provider call, a code path that skips the wrapper, a configuration flag — then the decision is advisory for that route, and coverage is a claim rather than a fact. This is why almost every serious implementation converges on the same shape regardless of vendor: something stands between the agent fleet and the things it can affect, resolves who is calling, decides whether the call may proceed, and records the outcome either way. What differs is the order of the checks and the honesty of the record, not the topology.

Three properties separate inline enforcement worth its cost from the decorative kind. It has to be able to refuse, not merely to record — a component that observes every request and stops none of them is a monitoring product in a load-bearing position, which is the worst of both trades. It has to be the only route, or the coverage gap has to be measured rather than assumed. And it has to be stageable: a rule whose false-positive rate you can only learn by switching it on will teach you that rate by stopping somebody’s work at an inconvenient hour. Shadow mode — running a rule over real traffic and recording what it would have done without doing it — is the mechanism, and the discipline that goes with it is that a shadow rule nobody looks at is not a dry run, it is a rule that does nothing.

Inside the path, order is load-bearing rather than tidy, and each position buys a specific guarantee. Text normalisation has to run before detection, because a scanner reading un-normalised input is examining a different document from the one the model will read — invisible Unicode can carry a complete instruction that a human reviewer and a naive pattern match both miss. The record has to be opened before anything can reject the request, because a request that vanished from the log is indistinguishable from one that was never made, and a refusal is evidence. And where a human is going to be asked to approve something, every narrowing check has to run first, so nobody spends attention approving a request that would be refused anyway. A system that performs the same checks in a different order is not doing the same thing.

The costs are real and should be stated beside the claim rather than under it. Enforcement adds latency to every governed call. It makes the enforcing component a dependency of everything it governs, which converts a governance property into an availability property. And it creates an approval queue, which is a durable organisational cost: an approval queue nobody reads is worse than no gate at all, because it manufactures the appearance of oversight and trains a human to click through it. Any of the three can make inline enforcement the wrong choice for a given estate — an estate of drafting assistants whose output a person reads before anything happens gains little from an inline refusal and pays the full price of the dependency.

Two places are hard to reach inline, and both invert the usual argument. The first is traffic that never arrives: an agent configured with a provider key directly is outside the perimeter by construction, which makes discovery a prerequisite for any coverage claim. The second is a developer’s own machine. Every major coding assistant’s tool hook fails open when it times out, so a hook that round-trips to a central server converts every outage, every slow connection and every name-resolution blip into a silent, organisation-wide bypass. The workable design is the counter-intuitive one — decide locally against a signed policy bundle issued in advance, treat any missing, malformed, unsigned, mis-addressed or expired bundle as a denial, and accept that a snapshot is not live state, so a kill switch engaged after issuance does not reach the machine until the next bundle. Token Observe ships that surface as a preview and says in its own documentation that it does not equal an inline network gateway on a device the organisation does not administer.