Control agent (global)

While the audit gate judges single tool calls, the control agent watches whole runs. Its rules are deterministic code. A hook for a reviewer exists in the code, but no reviewer is wired in today; an optional model second opinion that could only make a decision stricter is planned (0.4).

Actions

continue, pause or kill.

Rules

Rule	Triggers when	Default
budget_tokens, budget_cost, budget_steps, budget_tool_calls	a budget from agents.md is used up	from the agent
timeout	timeoutSeconds elapsed	from the agent
rate	more tool calls per minute than allowed (pauses until the window frees up)	30 per minute
loop	the same tool call is repeated	3 identical calls
error_streak	consecutive errors	3
policy_denials	the gate keeps denying	3 denials
forbidden_action	a forbidden action from the policy bundle is attempted	–
classification	run data is more sensitive than the provider’s clearance	–
reviewer	planned (0.4): an optional reviewer asks for a stricter action	not available

A kill caused by forbidden_action, classification or policy_denials ends the run as blocked_by_policy; other kills end it as failed with the error code control_<rule>.