Skip to main content
Kontext makes each decision on the endpoint while the agent waits. The workspace sends policy to the endpoint and receives records afterward. It takes no part in the decision.

​
The path of a tool call

The agent waits for the decision from the Kontext daemon. Everything involving the workspace happens in the background.

  1. The agent prepares a tool call. Its pre-tool hook sends the call to the Kontext daemon on the endpoint.
  2. The daemon evaluates the call against the endpoint’s current policy and decides Allow or Deny.
  3. The hook returns the result. In Enforce, the hook stops the call for Deny. In Observe, it lets the call run.
  4. If the call runs, the post-tool hook reports whether it succeeded or failed.
  5. The daemon sends the recorded call to the workspace in the background. It refreshes its policy about once a minute.
The daemon keeps the last policy it received and applies it while the endpoint is offline. Each endpoint receives dashboard policy changes on its next refresh.

​
What each decision does

Explore shows these messages at the top of each tool call, with the reason below. For an enforced Deny, the reason names the rule, for example “Blocked by rule block-github-force-push”.

​
How the workspace sets the mode

Policies has two lists, Enforced and Observing. The workspace saves each change and sends it to endpoints right away. You do not need a separate deploy step.
  • Until you enforce a policy, endpoints run the Observing list in Observe mode. Explore shows what each policy would decide on live tool calls.
  • The first time you click Enforce, the workspace switches to Enforce. From then on, endpoints run only the Enforced list.
  • After that switch, policies in Observing no longer run on endpoints. The dashboard replays them against recorded tool calls and shows how many calls each one would have blocked.
  • Pause stops policy on every endpoint. Kontext evaluates and blocks no tool calls. Explore shows each call as “Policy off: nothing was evaluated and the call ran.” Select Resume to turn policy back on.

​
When something fails

If policy evaluation fails, the call runs even in Enforce unless another request in the same compound command returned Deny. In Enforce, the hook denies tool calls when it cannot reach the Kontext daemon or the endpoint has no usable policy. See failure behavior for the full table.
Kontext lets a tool call run if policy evaluation fails, even in Enforce, unless another request in the same compound command returned Deny. Before you enforce a policy, test it in Observe and confirm that it produces decisions on real tool calls.

​
Risk and cost

The endpoint predicts risk right after the decision. The workspace assesses risk and calculates cost later. None of these changes a decision. Kontext can flag a denied tool call as risky.

​
Limits

Kontext sees only the events an agent’s hooks deliver. It does not isolate the file system or network at the operating system level. The agent reports a requested tool call through a pre-tool event. It reports completion through a post-tool event. Without a post-tool event, Kontext cannot confirm the outcome.