> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# How decisions work

> How Kontext decides tool calls in Observe and Enforce, including failure behavior.

export const ToolCallSequence = () => <div className="k-fig-wrap">
    <svg className="k-fig" viewBox="0 0 640 396" width="100%" style={{
  maxWidth: 640
}} role="img" aria-label="The agent's pre-tool hook sends the call to the Kontext daemon. The daemon evaluates the policy and replies Allow or Deny. Under Enforce, Deny stops the call. If the call runs, the agent reports the result. The daemon sends recorded calls and refreshes policy in the background.">
      <defs>
        <marker id="seq-arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
          <path className="arrowhead" d="M 1 1 L 8 5 L 1 9" />
        </marker>
      </defs>
      <text className="t-strong" x="90" y="22" textAnchor="middle">Agent</text>
      <path className="lifeline" d="M 90 34 L 90 376" />
      <text className="t-strong" x="320" y="22" textAnchor="middle">Kontext daemon</text>
      <path className="lifeline" d="M 320 34 L 320 376" />
      <text className="t-strong" x="550" y="22" textAnchor="middle">Workspace</text>
      <path className="lifeline" d="M 550 34 L 550 376" />
      <path className="line" d="M 90 64 L 320 64" markerEnd="url(#seq-arrow)" />
      <text className="t-small" x="205.0" y="57" textAnchor="middle">Tool call from pre-tool hook</text>
      <path className="line" d="M 320 84 h 34 v 26 h -34" markerEnd="url(#seq-arrow)" />
      <text className="t-small" x="362" y="101" textAnchor="start">Evaluate the policy</text>
      <path className="line" d="M 320 142 L 90 142" markerEnd="url(#seq-arrow)" />
      <text className="t-small" x="205.0" y="135" textAnchor="middle">Allow or Deny</text>
      <text className="t-muted" x="205" y="160" textAnchor="middle" style={{
  fontSize: 11
}}>Under Enforce, Deny stops the call</text>
      <rect className="box-soft" x="60" y="176" width="60" height="26" rx="4" />
      <text className="t-small" x="90" y="193" textAnchor="middle">Runs tool</text>
      <path className="line" d="M 90 232 L 320 232" markerEnd="url(#seq-arrow)" />
      <text className="t-small" x="205.0" y="225" textAnchor="middle">Result from post-tool hook</text>
      <path className="separator" d="M 30 262 L 610 262" />
      <text className="t-label" x="30" y="280" textAnchor="start">In the background, off the decision path</text>
      <path className="line-dashed" d="M 320 314 L 550 314" markerEnd="url(#seq-arrow)" />
      <text className="t-small" x="435.0" y="307" textAnchor="middle">Send recorded tool calls</text>
      <path className="line-dashed" d="M 550 356 L 320 356" markerEnd="url(#seq-arrow)" />
      <text className="t-small" x="435.0" y="349" textAnchor="middle">Policy refresh, about once a minute</text>
    </svg>
  </div>;

Kontext makes each decision on the endpoint while the agent waits. The workspace sends policy to the endpoint and receives records afterward. It takes no part in the decision.

## The path of a tool call

<Frame caption="The agent waits for the decision from the Kontext daemon. Everything involving the workspace happens in the background.">
  <ToolCallSequence />
</Frame>

1. The agent prepares a tool call. Its pre-tool hook sends the call to the Kontext daemon on the endpoint.
2. The daemon evaluates the call against the endpoint's current policy and decides Allow or Deny.
3. The hook returns the result. In Enforce, the hook stops the call for Deny. In Observe, it lets the call run.
4. If the call runs, the post-tool hook reports whether it succeeded or failed.
5. The daemon sends the recorded call to the workspace in the background. It refreshes its policy about once a minute.

The daemon keeps the last policy it received and applies it while the endpoint is offline. Each endpoint receives dashboard policy changes on its next refresh.

## What each decision does

| Decision | Under Observe                   | Under Enforce                   |
| -------- | ------------------------------- | ------------------------------- |
| Allow    | "Would allow: the call ran."    | "Allowed: the call ran."        |
| Deny     | "Would deny: but the call ran." | "Denied: the call was blocked." |

**Explore** shows these messages at the top of each tool call, with the reason below. For an enforced Deny, the reason names the rule, for example "Blocked by rule block-github-force-push".

## How the workspace sets the mode

**Policies** has two lists, **Enforced** and **Observing**. The workspace saves each change and sends it to endpoints right away. You do not need a separate deploy step.

* Until you enforce a policy, endpoints run the **Observing** list in Observe mode. **Explore** shows what each policy would decide on live tool calls.
* The first time you click **Enforce**, the workspace switches to Enforce. From then on, endpoints run only the **Enforced** list.
* After that switch, policies in **Observing** no longer run on endpoints. The dashboard replays them against recorded tool calls and shows how many calls each one would have blocked.
* **Pause** stops policy on every endpoint. Kontext evaluates and blocks no tool calls. **Explore** shows each call as "Policy off: nothing was evaluated and the call ran." Select **Resume** to turn policy back on.

## When something fails

If policy evaluation fails, the call runs even in Enforce unless another request in the same compound command returned Deny. In Enforce, the hook denies tool calls when it cannot reach the Kontext daemon or the endpoint has no usable policy. See [failure behavior](/policies/rollout#failure-behavior) for the full table.

<Warning>
  Kontext lets a tool call run if policy evaluation fails, even in Enforce, unless another request in the same compound command returned Deny. Before you enforce a policy, test it in Observe and confirm that it produces decisions on real tool calls.
</Warning>

## Risk and cost

The endpoint predicts risk right after the decision. The workspace assesses risk and calculates cost later. None of these changes a decision. Kontext can flag a denied tool call as risky.

## Limits

Kontext sees only the events an agent's hooks deliver. It does not isolate the file system or network at the operating system level. The agent reports a requested tool call through a pre-tool event. It reports completion through a post-tool event. Without a post-tool event, Kontext cannot confirm the outcome.