Before an AI agent acts,
Interlock decides whether it should.
Interlock intercepts consequential agent actions before execution, applies policy, routes exceptions to the right human, and records exactly what was authorised.
Agents can decide what to do.
That is not the same as being allowed to do it.
Model reasoning determines what an agent wants to do. Interlock determines whether that action is authorised — and if it is not, who decides instead.
Without Interlock
The first time a human sees it, the money has already left.
With Interlock
Nothing consequential happens without someone answerable for it.
Four stages between intent and execution.
Intercept
The agent's tool call is captured before it reaches the outside world.
POST /refunds
heldEvaluate
Policy, scope, decision class and reversibility are resolved for this exact request.
refund_limit v4
irreversible · externalDecide
Allowed automatically, routed to a named human, or refused with a stated reason.
approve · edit · deny · hand overRecord
The decision and the exact card shown at that moment are written once, and never rewritten.
29.08 02:58 · L. Arslanova
immutableThis is the screen a reviewer actually sees.
Not a marketing abstraction. The card carries everything needed to decide, and nothing that would decide for you.
Human decisions refine policy.
They are not graded by it.
When a reviewer and the policy would have differed, Interlock records the divergence and returns it to the rule. It does not decide who was right.
A reviewer denies a $180 refund — the customer's third that week.
The divergence is written once, with the exact card shown at the time.
A draft is derived, runs in shadow, and waits for someone to switch it on.
A rule proves itself before it can change anything.
Drafts see every intercepted action and record what they would have decided. They influence nothing until a named person promotes them.
Open Rules → Eighteen of eighteen is not proof that a rule is right — it can also mean the hard cases never arrived. Interlock says so on the screen rather than promoting the rule for you.
Reversible and irreversible actions are not the same problem.
Irreversible marks the action, not the amount. Money that has left cannot be pulled back, while an export or a plan change is undone inside its window.
Revocation can stop what has not happened yet.
Not a gimmick — it makes an irreversible approval impossible to give by reflex.
Failure should change the system state —
not disappear into a log.
When Interlock cannot answer, agents are stopped rather than let through, and the refusal carries the reason that caused it.
Agents are stopped, not running unchecked
Every action outside policy is refused with “interception unavailable” as the stated reason.
The queue is not updating
Decisions already sent are safe. What is uncertain is what arrived after the connection dropped.
It becomes a refusal
Named honestly, rather than left waiting for a person who is not there. It is not called an escalation when there is no one to escalate to.
This request no longer exists
Decided elsewhere, withdrawn, or expired fail-closed. Links outlive requests by design.
Every consequential decision leaves evidence.
A record is written once. A later revocation is a second record; the first is never rewritten. Retained seven years.
Interlock does not invent certainty.
It knows the decision was sent. It does not know how the execution ended. An approved refund may have failed in billing and is still counted here as approved.
Until outcomes come back into the log, a “share of correct decisions” would be invented — so there is none.
Interlock stands before the action, not after it. Execution results never return to the log, so the product does not claim them.
Five surfaces, one chain of custody.
Actions worth stopping.
Who answers for what.
Decision class
A money reviewer cannot decide a data action. Misrouted requests are handed over, never declined silently.
Amount limits
Above the limit the request goes to the duty lead — separate from the rule threshold.
Escalation
Named, not “the next shift”. An escalation without a name is not an escalation.
Handover
Open requests cross shifts with their timers intact. Nothing is closed or re-queued by the change of shift.
Rule ownership
Whoever promotes a rule becomes its author — not the reviewers whose decisions produced it.
Immutable records
Written once, retained seven years, never rewritten by a later decision.
Give AI agents authority
without giving up control.
Interlock gives agentic systems a decision layer before consequential actions become real.