Verdicts

Before a covered action executes, the client returns one of four verdicts: Allow, Ask, Block or Optimize. A verdict is deterministic because an explicit policy produced it.

Figure 1. Every covered action reaches the policy decision point before it runs. The effective zone's intent policies produce one deterministic verdict.

Verdict	What happens
Allow	The action runs. In Monitor, it may run and be flagged
Ask	By default the action runs and is flagged for asynchronous review; it holds only where an atom opts in for an irreversible action
Block	The action does not run. The agent receives a native refusal that names the rule that produced it
Optimize	The path changes. In Enforce a lever acts; in Monitor it measures what it would have done

When several policies match one action, the most restrictive verdict wins, in this order: Block, then Ask, then Optimize, then Allow.

Ask

Ask lets the action run and flags it for review, so a person can decide whether the agent should do it again. It prevents recurrence, not the first occurrence. An atom can opt in to hold an irreversible action until it is answered; nothing else waits on a person.

How Ask reaches the agent depends on the agent. Claude Code receives it as its own native ask, carrying the rule’s reason. Codex CLI has no ask of its own, so it receives a message carrying the reason, and the call proceeds.

Optimize

Optimize changes the path of an action instead of stopping it. Each change is made by a lever, and what a lever does depends on the mode of the policy.

Lever	Status
`loop_stop`	Acts in Enforce; measures in Monitor
`steer`	Acts in Enforce; measures in Monitor
`narrow_output`	Acts in Enforce on Claude Code; measures in Monitor
`effort_clamp`	Measures by default, in Monitor and Enforce alike; acts in Enforce only where you opt in
`context_edit`	Measures by default, in Monitor and Enforce alike; acts in Enforce only where you opt in
`prefix_guard`	Measures by default, in Monitor and Enforce alike; acts in Enforce only where you opt in
`substitute`	This lever is not shipped, and in Monitor it measures only

In Monitor, a lever only measures what it would have done, and the record says so. In Enforce, it is applied.

One action, four verdicts

Illustrative scenario. The same action, git push, can earn each verdict depending on its context:

Context	Verdict
An agent pushes a feature branch of a repository its team owns	Allow
An agent pushes to a shared release branch	Ask: the push runs and is flagged for review
An agent force-pushes to the main branch of a production repository	Block
An agent retries the same failing push in a loop	Optimize: in Enforce, `loop_stop` ends the loop