🛡️ Deterministic Controls
Guards, gates, contracts, and probes are executable rules that return pass or fail.
Why
Agents generate changes faster than people can review them. Safety rules must run automatically.
A squad or agent should have to work hard to do something unsafe, and should never have to work hard to do something safe.
A written policy is not a control until it is executable.
Deterministic Controls and Persistent Context
Deterministic controls are not the same thing as Persistent Context, but they are part of it.
- Different jobs. Context guides the model; controls enforce rules with pass/fail results.
- Same distribution. Controls are versioned skills in a shared or project repository. Projects install and run them like other context. See coding-pal.
Automated checks and deterministic controls
Both are deterministic: a script returns pass or fail, never an opinion. They differ in what they check.
| Automated checks | Deterministic controls | |
|---|---|---|
| What | Compiler and build, type checks, linters, and automated tests generated with the code | Guards, gates, contracts, and probes |
| Purpose | Prove the code works | Prove the change is safe to merge and release |
| Where they run | In the agent harness in 4 — Code, then again in the CI on the pull request in 5 — Prove | The same two places |
| Can the agent change them? | The agent writes the tests, so it can edit them | The rules and scripts are fixed, and the agent runs them but does not change them. Generated test suites are held to account by Criteria Test Verification and Mutation Testing |
Run checks in the agent harness for fast fixes. Repeat them in clean CI, with CI-only controls such as preview smoke tests.
The controls
| Control | Type | Runs in | Enforcement | Purpose |
|---|---|---|---|---|
| Secret & Push Protection | Guard | Agent harness, commit time, and CI | Platform git hooks & CI | Blocks commits containing credentials, tokens, or private keys immediately |
| Policy-as-Code | Guard | Agent harness and CI | Open Policy Agent (OPA) / Conftest | Enforces infrastructure, security, and cloud configuration rules deterministically |
| License & SAST Scan | Guard | Agent harness and CI | Semgrep / Snyk / Trivy | Blocks unauthorized open-source licenses and known vulnerable dependencies |
| Clean CI Re-run | Gate | CI (backstop) | CI in a clean environment | Repeats the checks and controls on the pull request, where the agent cannot influence the result |
| Criteria Test Verification | Gate | Agent harness and CI | Test runner | Proves that 100% of acceptance criteria from the Plan record have passing assertions |
| Mutation Testing Bar | Gate | Agent harness and CI | Stryker / Mutmut | Proves that generated test suites are meaningful and actually catch injected defects |
| Contract & Schema Compatibility | Contract | Agent harness and CI | OpenAPI / JSON Schema / Pact | Proves that changes do not break external consumers or downstream APIs |
| API Tests | Contract | Agent harness and CI | HTTP API tests (for example Supertest) | Proves each endpoint returns the agreed status codes and responses |
| Fuzz Tests | Probe | CI (preview) | API fuzzing from the OpenAPI spec (for example RESTler) | Proves the API handles unexpected and malformed input without errors or crashes |
| Database Tests | Gate | Agent harness and CI | SQL assertions against a migrated database | Proves the schema and migrations behave as specified |
| E2E Tests | Probe | CI (preview) | Browser tests of real user journeys (for example Playwright) | Proves the main journeys work on the running application |
| Preview Smoke Tests | Probe | CI (preview) | Ephemeral preview | Proves the application starts, routes traffic, and responds to health checks |
How the controls get stronger
7 — Learn feeds back into this page: a defect or rollback that a control should have caught earlier becomes a stricter gate, threshold, or probe.
Failure mode to avoid
Controls that fire constantly on false positives get disabled. Each control has an owner who watches its signal-to-noise ratio; a control that is routinely bypassed is either fixed or removed, never left as decorative.