How OpenLatch works
This page follows one action from the moment the agent attempts it to the moment its record reaches the platform. Policy is written once, on the platform. Each decision is made on the machine, by the client, with no network call.
1. Policy reaches the client
Section titled “1. Policy reaches the client”You ratify intent policies in the console. The platform compiles them and builds one policy bundle for each agent, from that agent’s effective zone. The client asks the platform for its bundle at regular intervals:
| The platform answers | The client |
|---|---|
| Nothing changed | Keeps the bundle it holds |
| A new bundle | Checks its integrity, then swaps it in whole |
| Nothing, or a bundle that fails the check | Keeps the last valid bundle |
To fetch the bundle at once, run openlatch system aip refresh.
2. The hook catches the action
Section titled “2. The hook catches the action”The client plugs into the agent’s own native hooks. When the agent attempts a covered action, such as running a shell command or calling a tool, the hook passes it to the client before it executes. Outbound model requests pass through a listener on the same machine.
3. The client decides
Section titled “3. The client decides”The client evaluates the action against its resident bundle, in memory, on the machine. There is no network call on this path, so the agent never waits on the network and the verdict never depends on it. When several policies match, the most restrictive verdict wins. Verdicts and Modes explain what each verdict does in Monitor and in Enforce.
4. The record follows
Section titled “4. The record follows”After the decision, the client redacts credentials on the machine and sends the record of the action and its verdict to the platform. The platform stores that record for the audit trail, the execution graph and reporting. It never decides again and never changes a verdict the client already returned.
Offline
Section titled “Offline”The resident bundle is the authority, not a cache. With the network unplugged, the client keeps applying the last valid bundle, indefinitely. Fetching new policy and sending records need a connection; deciding does not.
Two situations leave an action undecided, and the action then proceeds: the machine has never held a valid bundle, or the hook cannot reach the client on its own machine. openlatch doctor reports both.