AIP reference

Use this page to read or review an Agent Intent Policy (AIP): what it is made of, which dimension of the Autonomy Zone it covers, which mode it runs in, and which verdict it returns for a covered action.

An intent policy states what your organization means, rather than every surface an agent might use. OpenLatch writes each intent policy as an AIP and compiles it to deterministic rules that the client applies before the action runs.

Intent atoms

An AIP is a set of one or more intent atoms. One clause of your source document becomes one atom, and every atom has the same fixed fields.

Field	Contents
who	The agents the atom applies to. When the source does not say, the atom states that it was inferred
does what	The action, such as a deployment or a file deletion
to what	The target of the action, such as a production namespace
only if	The conditions under which the action is acceptable
unless	The exceptions to the atom
class	Whether the atom can be enforced: enforceable, monitor-only or out-of-scope

From these fields OpenLatch generates a sentence and a set of test cases. You never edit the compiled rules.

You see	What it is for
The sentence	What you ratify, with one Yes or No
The source	The clause of your document the atom comes from, quoted so you can check it was read correctly
The test cases	Concrete situations with the verdict each one would get, shown read-only beside the sentence so your answer is informed

A No sends the atom back for correction: you say what you meant, the fields change, and the atom returns with a new sentence and new cases for a fresh answer. Changing an atom always cancels the ratification given to its earlier version.

An atom’s class is a property of the atom, not a setting. A monitor-only atom describes something that can be observed but not stopped before it happens, so it stays in Monitor even when its policy is in Enforce.

Dimensions

Every atom belongs to one of the five dimensions of the Autonomy Zone. A policy covers the union of its atoms’ dimensions.

Dimension	The question it answers	Example intent policies
Quality	Is the work up to standard?	Code is tested before it ships; the mandated process is followed
Economics	Is the cost justified?	No runaway loops or pointless retries; the model matches the task
Security	Can it touch this?	No credential leaves the corporate boundary; only approved tools and servers
Safety	Is the consequence acceptable?	No production access without approval; no irreversible or destructive operations
Compliance	Is it lawful and by the book?	Internal policies and standards; contractual obligations

The mission is not a dimension: each agent brings its own mission, and the zone brings the rules it must follow.

Modes

A policy runs in one of three modes. The mode belongs to the policy, never to an atom, and is set in each Autonomy Zone that holds the policy.

Mode	What happens on a match
Disabled	Nothing. The policy and its history are kept, but it is not evaluated
Monitor	The match is recorded as an anomaly and flagged; the action proceeds
Enforce	The verdict is applied before the action runs, wherever an adapter covers that action, and the record states whether it was actually enforced

When an agent’s zones hold the same policy more than once, it runs once, in the strictest mode: Enforce over Monitor over Disabled.

Policies earn Enforce on evidence: run a policy in Monitor, review its anomalies, and move it to Enforce once it is accurate. OpenLatch never widens an agent’s authority on its own.

Verdicts

Every covered action that matches a policy in Enforce receives one of four verdicts before it runs. A verdict is deterministic because an explicit policy produced it.

Verdict	What happens to the action
Allow	The action proceeds unchanged. In Monitor, it may be allowed and flagged
Ask	The action is allowed and flagged for review by default
Block	The action is prevented before it runs. The agent gets the reason and can try something else; the session continues
Optimize	The action takes a different path, through one of the levers below

Ask

Ask allows the action and flags it for asynchronous review by default. The review decision, with the scope the reviewer picks, travels to the client in the next policy bundle, so the next similar action is decided on the machine without a person.

Ask holds an action and waits for approval only on a per-atom opt-in for an irreversible action, such as dropping a production database.

Codex CLI has no native ask prompt. On Codex CLI, Ask surfaces to the agent as a message with the rule’s reason, and the call proceeds.

Ask prevents recurrence, not the first occurrence. Write anything that must never happen unreviewed as Block, or mark the action irreversible on its atom.

Optimize levers

Optimize changes the path of an action instead of allowing or blocking it. The mode decides what a lever does: in Enforce a lever acts, and in Monitor a lever only measures what it would have done.

Lever	What it changes	Status
loop_stop	Stops an agent that repeats the same call, and tells it why	Acts in Enforce
steer	Refuses the action and tells the agent what to do instead, such as pushing a branch rather than the main branch	Acts in Enforce
narrow_output	Returns a filtered subset of a long command output to the agent, and keeps the full output on disk	Acts in Enforce, on Claude Code
effort_clamp	Lowers the reasoning effort of a model request	Measures in Monitor and in Enforce; acts in Enforce only where the customer opts in
context_edit	Tightens the context-clearing settings of a model request	Measures in Monitor and in Enforce; acts in Enforce only where the customer opts in
prefix_guard	Keeps the cached prompt prefix of a model request stable	Measures in Monitor and in Enforce; acts in Enforce only where the customer opts in
substitute	Swaps a command for an equivalent your organization approved	Not shipped: it has no actuator and only measures in Monitor

In Enforce, loop_stop, steer and narrow_output act (narrow_output on Claude Code). effort_clamp, context_edit and prefix_guard only measure, even in Enforce, unless the customer opts in. substitute is not shipped, so it only measures in Monitor. In Monitor, every lever only measures.

The evidence record says which applies: applied in Enforce, measured in Monitor.

What a verdict covers

Every covered action reaches the policy decision point, and its verdict is enforced. An action outside a covered surface, such as a script the agent wrote earlier and runs later, is not decided by the client. Each agent’s control level states which coverage applies to it.