What the agent receives on a Block

Use this page to know what an agent and its operator see when an intent policy in Enforce blocks an action, and where that text goes.

The agent receives the ratified sentence

When an intent policy in Enforce blocks an action, the client refuses the action and gives the agent, as its reason, the sentence your organization ratified, in the language of its brief. A fixed line follows it, naming it as an OpenLatch policy, so the agent reads it as a quoted policy rather than an instruction. Where the intent policy asks the agent to declare a fact, its questions follow in the same reason. The agent can then try something else, and the session continues.

The sentence is stored as plain text: control characters, markup and code blocks are stripped when the policy is prepared, and its length is capped. The action the agent attempted is escaped before it appears in the operator notice.

The operator receives a notice

On every agent that can show one, the operator also receives a notice: what was blocked, the action, the AIP and its sentence, and that nothing was executed. The console shows the decision and its anomaly as for any Block.

Per agent

The client returns the refusal through each wired agent’s own refusal surface. Whether that reason then reaches the agent’s model is measured agent by agent, and the table states only what has been measured.

Agent	Delivery	Control level	Deny reason reaches the model
Claude Code	Any	Enforced on the command plane	Measurement in progress; no result published yet
Codex CLI	Managed, through MDM, a system setting or a cloud setup	Enforced on the command plane	Not measured
Codex CLI	Self-serve	Monitored on the command plane until the developer trusts the OpenLatch hook inside Codex CLI, then Enforced on that plane	Not measured
Cursor	Self-serve, in the IDE and the CLI, on macOS and Windows	Enforced on the command plane	Not measured
Cline	Self-serve, in VS Code, on macOS	Monitored on the command plane	Not measured
Devin	Self-serve, the Devin CLI on macOS, build 3000.11.228 or later	Enforced on the command plane	Not measured
Devin	Self-serve, Devin Desktop on macOS, Windows and Linux, and the Devin CLI on Windows and Linux	Monitored on the command plane	Not measured
OpenCode	Self-serve, in the terminal UI and its run command, on macOS, Linux and Windows	Monitored on the command plane	Not measured

Returning the sentence never changes an agent’s control level. Where an install is Monitored on the command plane, the decision is recorded, and the refusal reaches the agent only as far as that agent loads the hook. Control levels explains each level.

Where the sentence goes

Destination	When
The agent, and through it the agent’s model provider	On every Block, since the reason becomes part of the agent’s context
The notification channels your organization configures	On every anomaly with an Ask or a Block verdict, for the channels subscribed to it. See Set up notification channels

There is no option to replace the sentence with a neutral reason. Write each sentence knowing that the agent, its model provider and your own channels read it. Data handling and security lists every flow.