Trigger
A coding agent proposes a shell action through Claude Code, an SDK integration, or another tool adapter.01
Shell command guardrails
Stop dangerous shell commands before they run.
Evaluate each proposed Bash, sh, or zsh action as structured input, then deny it or require exact-action approval before the coding agent can execute it.
What breaks
A destructive command reaches root, system paths, repository history, production infrastructure, or another sensitive target before a person sees it.Control point
Match deterministic shell facts and exact parameters against enabled tool policies, then deny, defer, or require approval before the executor runs the command.01Proposed command
→02Policy + shell facts
→03Decision
→04Agent executor
Live flow
Follow the action through the decision.
The walkthrough below is native page UI: proposal, policy facts, decision, and the point where the customer-owned executor continues or stops.
Proposed action
Bash proposes a destructive action
rm -rf /- Tool
- claude-code / Bash
- Workspace
- /workspace/project
Policy check
Tool policy matches shell facts
- Risk
- filesystem_recursive_delete
- Target
- root
- Action
- deny
Decision
Return an explicit effect
rm -rf /DeniedSystem target blocked
rm -rf ./buildApproval requiredExact action waits
Execution
The executor stays paused
Denied commands never run. An approved command receives one action-bound execution lease.
Execution boundaryAnalysis parses the command as structured input and never invokes the shell.
How it works
- 01Describe
Capture the exact proposed action
Submit the command, shell, working directory, workspace root, timeout, stable invocation, and complete tool identity before execution.
- 02Analyze
Derive bounded shell facts
Featherlane AI parses executable syntax without running the command, then identifies targets, wrappers, destructive operations, dynamic evaluation, and incomplete analysis.
- 03Decide
Apply the enabled tool policy
Known prohibited actions are denied. Workspace-sensitive actions can wait for an exact, non-reusable approval that is bound to the original parameters.
- 04Prove
Tie approval to one execution attempt
The caller resubmits the same action with its grant. A changed command does not fit, and the execution lease is consumed or canceled after the attempt.