Skip to content
ThreefoldAgent governance

Threefold · governance for coding agents

Stop bad agent writes before they reach your code.

With the hook installed, deterministic gates on AWS check supported tool calls from Claude Code, Codex, Antigravity and Muse. Architecture rules start in Observe; teams promote selected rules to Enforce.

An agent proposes a write Asking the stack
    Asking Threefold whether it may be written

    Asking this stack through POST /evaluate-tool-call, the route every hook calls.

    A refusal is measured to stop the write in Claude Code and Antigravity, in Codex once, over its patch tool only, and in Muse over its file-write, edit and shell tools.

    Proof

    At work on this stack, and measured in a benchmark

    How it works

    The agent asks, Threefold decides, you see everything

    Plain code decides. Bedrock explains verdicts and drafts rules for review.

    1. Step one

      The hook asks

      The hook checks supported calls. Known credentials and hook-disabling attempts are refused locally.

    2. Step two

      Threefold judges, on AWS

      Gates check layering, known credentials, repeats and caller-declared token budgets. Refusals explain why, with a checked fix where one can be made.

    3. Step three

      The dashboard shows

      The ledger shows refusals, would-refuse calls and rules ready to enforce.

    How a tool call travels An installed hook checks a supported tool call. It refuses known credentials locally and sends other covered calls to Threefold on AWS. The service returns a deterministic verdict; the hook refuses the call with a reason and a checked fix where one can be made, or lets it run. Recorded decisions feed the dashboard. Coding agent Claude Code · Codex Antigravity The hook on your machine; credentials stay there Threefold, on AWS deterministic gates decide; Bedrock explains The dashboard every verdict, in a ledger you review asks first the call verdict deny + why ledger How a tool call travels An installed hook checks a supported tool call. It refuses known credentials locally and sends other covered calls to Threefold on AWS. The service returns a deterministic verdict; the hook refuses the call with a reason and a checked fix where one can be made, or lets it run. Recorded decisions feed the dashboard. Coding agent Claude Code · Codex · Antigravity The hook, on your machine credentials stay there Threefold, on AWS gates decide; Bedrock explains The dashboard every verdict, in a ledger you review asks first deny + why the call verdict ledger
    A refusal gives the agent a reason and a checked fix where one can be made. No verdict waits on a model.

    Observe first. Promote trusted rules.

    Review what architecture rules would refuse, promote selected rules to Enforce and demote with one click.

    1. Observe

      Architecture rules observe first. Credential and hook-protection checks remain active locally.

    2. Review

      Mark each would-refuse correct or a false alarm. A rule whose every flag was correct reads Ready.

    3. Enforce

      Promote the ready rules and they refuse. The rest keep observing.

    Demote is one click back to Observe, whenever a rule misbehaves.

    Measured on one Windows machine by what was on disk afterwards, not by what the agent said: two open bug reports say a deny can be ignored.

    Built on AWS

    Serverless from the edge to the ledger

    One function behind an edge that filters and throttles, one table for every verdict, and a model that explains but never decides.

    The AWS services Threefold runs on Browsers and hooks reach CloudFront with AWS WAF, which serves the pages and forwards API calls to API Gateway; API Gateway invokes one AWS Lambda function that runs the gates; it records verdicts in Amazon DynamoDB, asks Amazon Bedrock for page explanations and rule drafts, never for a verdict, and is invoked on a schedule by Amazon EventBridge Scheduler to run the synthetic demo fleet. Browsers, hooks pages and tool calls CloudFront + WAF pages, rate limits API Gateway HTTP API, throttled AWS Lambda the gates, one function DynamoDB ledger, sessions, rollups EventBridge Scheduler the synthetic demo fleet Amazon Bedrock explains, never decides on a schedule explain, draft The AWS services Threefold runs on Browsers and hooks reach CloudFront with AWS WAF, which serves the pages and forwards API calls to API Gateway; API Gateway invokes one AWS Lambda function that runs the gates; it records verdicts in Amazon DynamoDB, asks Amazon Bedrock for page explanations and rule drafts, never for a verdict, and is invoked on a schedule by Amazon EventBridge Scheduler to run the synthetic demo fleet. Browsers, hooks pages and tool calls CloudFront + WAF pages, rate limits API Gateway HTTP API, throttled AWS Lambda the gates, one function DynamoDB the ledger Amazon Bedrock explains, drafts EventBridge Scheduler runs the synthetic demo fleet

    Edge in us-east-1, service in eu-west-1. The scheduler runs only on the public demo, where it feeds the synthetic Acme fleet.

    The architecture, in depth

    Watch the gates

    Watch the gates refuse, with no account

    Four scenarios and the universal adapter. Each calls the live service and shows what came back. The circuit breaker halting a loop (Scenario 1) and a governance certificate (Scenario 4) take one click each, both in under 60 seconds.

    Checking the service

    Result

    Pick a scenario above

    Awaiting input Circuit breaker: armed
    agent-telemetry-streamIdle

    // Ready. Each scenario sends real calls to this stack and prints what comes back; with no answer, the first four replay a recorded run.

    1 · Loop POST /simulate-loop

    2 · Credential POST /simulate-secret

    3 · Architecture POST /evaluate-tool-call

    4 · Certificate POST /evaluate-tool-call ×4, POST /issue-certificate

    Adapter POST /adapter/universal-tool-call

    Deterministic gates

    No secret in the call--
    Clean architecture boundary--
    No loop--
    Cost circuit breaker--

    Why, in a sentence

    Waiting for a scenario: its verdict is explained here, with the name of whatever wrote the sentence.
    Projected spend none yet
    What these buttons call, in the contract:
    Connection and operator controlschecking /status