← All posts
By The agentjail team
announcementrelease

v0.9.0: See what your policy would block

Monitor mode shows what a rule would allow, deny, or ask about before you enforce it, plus verified daemon attestation and control-plane token auth.

A monitor-mode log showing tool calls tagged with the verdict policy would have returned - Read would ALLOW, Bash would ASK, Write to ~/.ssh would DENY - with nothing enforced.

agentjail v0.9.0 is out. The headline is monitor mode: a way to run a policy against your real workflow and see exactly what it would allow, deny, or ask about, without it blocking anything yet. Alongside it, attestation now verifies the policy daemon end to end, and a new control-plane token keeps the sandboxed agent away from the sockets that run the guard.

TL;DR

  • Monitor mode evaluates every tool call and enforces nothing, recording the verdict that would have fired - so you can try a rule against how you actually work before you turn it on.
  • Attestation now verifies the daemon end to end. The status line pings the policy daemon rather than assuming it, shows UNSECURED when you are not shielded, and defaults to a degraded posture instead of silent-allow when the daemon is unreachable.
  • Control-plane token auth requires a token on every privileged verb across the daemon, netproxy, and secrets broker - a token the shield withholds from the sandboxed agent.
  • agentjail doctor --fix repairs what it diagnoses - a dangling PATH shim, a stale supervisor, missing symlinks - instead of just reporting it.

Monitor mode: see what your policy would block

Turning on a new rule against a live workflow is a leap of faith. You do not know what it will catch until it blocks something you needed, and by then you are debugging a guardrail instead of shipping.

Monitor mode removes the leap. The daemon evaluates every tool call exactly as it would under enforcement - same rules, same verdicts - but it enforces nothing. Every decision it would have made is recorded without ever acting on it.

agentjail monitor surfaces those recorded verdicts, so you can see precisely what a rule set would have allowed, denied, or asked about across a real session:

$ agentjail monitor
Read   src/app.go          would ALLOW
Bash   rm -rf /tmp/cache    would ASK
Write  ~/.ssh/config        would DENY
MCP    github.create_pr     would ALLOW

Write a rule, watch it run against how you actually work, and flip it to enforcing only once you trust it. It is the difference between guessing a policy is right and knowing it.

Attestation you can verify

A status badge is only worth as much as what it checks. Until now, agentjail’s status line went green on one fact: the shield had launched. That is a necessary condition for enforcement, but not a sufficient one - the policy daemon behind the shield still has to be up and answering for a tool call to actually be evaluated.

v0.9.0 closes that gap. The status line now pings the policy daemon and attests it directly, end to end, rather than inferring it from the shield alone. If you are not shielded, it says UNSECURED - no ambiguity. If the daemon is unreachable, policy defaults to a degraded posture instead of silently allowing everything through, and the status stops claiming secured. AGENTJAIL_SHIELDED=1 now means the agent is genuinely sandboxed, not merely that the shield process ran. A green badge is now a verified claim: the guard is live, and every call is being evaluated.

The same honesty runs through the fail-open path - when the daemon is down, the notice now surfaces where you will actually see it, including a warning to Codex users during the outage window.

The guarded shouldn’t be able to disable the guard

The daemon, netproxy, and secrets broker each expose a privileged control socket: reload policy, register a session, read or write a secret, approve a grant. Before v0.9.0, those verbs were reachable by anything that could open the socket - including the sandboxed agent itself. An agent running inside the sandbox could, in principle, talk to the same socket that reloads policy or approves a credential grant.

v0.9.0 adds a control-plane token. Every privileged verb across the daemon, netproxy, and secrets broker now requires it, and the shield withholds that token from the sandboxed agent. Policy reload moved off the agent-reachable socket onto the privileged one. The thing being guarded can no longer reach the guard’s control plane to weaken it.

Also in this release

  • agentjail doctor --fix repairs what it diagnoses - dangling PATH shim, stale or wedged supervisor, missing symlinks - instead of only reporting the problem.
  • Secrets are redacted by value, not just by key name - a secret pasted into an unexpected field is still masked in the audit log.
  • Rego input is type-checked against the HookInput schema - policy add now fails closed on an unknown input.* reference instead of silently matching nothing.
  • Total uninstall - stops the daemon before unhooking, verifies it stopped, aborts rather than tearing down half-way, and restores any chained status line.
  • Daemon durability - WAL checkpoint instead of VACUUM-on-start, SIGHUP reload coalesced and rate-bounded, buffered decisions survive shutdown.

Upgrading

Nothing changes in how you use agentjail. curl-based installs, brew upgrade, and the built-in self-update all produce the new behavior automatically; existing config and policy keep working untouched. Reach for agentjail monitor the next time you want to add a rule - watch it in monitor mode first, then enforce it with confidence.