Control levels
Every agent in the agent record carries a control level. It tells you what OpenLatch can actually do with that agent, so you never have to assume an agent is controlled because it is listed.
| Control level | What it means |
|---|---|
| Enforced | The client sits in the agent’s execution path. A verdict reaches the agent and is obeyed |
| Monitored | The integration is installed and events flow, but a verdict cannot be delivered yet, so nothing is prevented |
| Known | The agent is identified and classified, with the limits of control stated |
Coverage is a deployment outcome. The control level is what the deployment achieved for that agent, not a promise about every agent of its kind.
Two planes
Section titled “Two planes”An agent is covered on two planes, and the control level is always stated per plane.
| Plane | What it catches | What it can carry today |
|---|---|---|
| Command plane | A tool call or shell command, caught at the agent’s native hook | Allow, Ask, Block or Optimize, decided before the action runs. Optimize is Monitor-first |
| Request plane | An outbound model request, caught at a listener on the same machine | Allow and record by default, so it is Observed: captured and measured. Ask has no meaning here, and Block is not shipped on this plane |
Agents wired today
Section titled “Agents wired today”| Agent | Delivery | Command plane | Request plane |
|---|---|---|---|
| Claude Code | Any | Enforced on the command plane | Observed on the request plane |
| Codex CLI | Managed, through MDM, a system setting or a cloud setup | Enforced on the command plane, and the developer cannot turn it off | Observed on the request plane |
| Codex CLI | Self-serve | Monitored on the command plane until the developer trusts the OpenLatch hook inside Codex CLI, then Enforced on that plane | Observed on the request plane |
| Cursor | Self-serve, in the IDE and the CLI, on macOS and Windows | Enforced on the command plane | Observed on the request plane |
| Cline | Self-serve, in VS Code, on macOS | Monitored on the command plane | Observed on the request plane |
openlatch status and openlatch doctor report each agent on the machine with its control level.
How each agent receives a verdict
Section titled “How each agent receives a verdict”Not every agent can express every verdict natively. A verdict an agent cannot express is delivered as the nearest one it can, recorded as such, and never stricter than the rule intended.
| Agent | Ask | Block |
|---|---|---|
| Claude Code | Its own native ask | Its native refusal |
| Codex CLI | A message carrying the rule’s reason; the call proceeds | Its native refusal |
| Cursor | Native on shell commands and MCP calls in some of the IDE’s run modes; elsewhere the action is allowed and the record says Ask could not be delivered | Its native refusal |