What works today
TracePermit demonstrates a practical boundary for coding-agent tool requests: authenticate the request, independently review its exact action, then explicitly resume with single-use authority. The Java backend and React inbox run locally; all target effects are simulated. This is an open-source evaluation preview, not a production security gateway or public enforcement service.
The approval loop
- Request: a supported client submits bounded simulated arguments. Policy returns a durable pending request, with an exact action hash and expiry.
- Review: a distinct authorized human inspects and approves or denies it. Approved still means not executed; the agent cannot review itself.
- Resume: the original requester explicitly resumes the same ID/hash. PostgreSQL atomically consumes the approval and claims execution before dispatch.
- Inspect: authenticated history shows the stored status and outcome. Expiry, changed bindings, denial or consumed authority cannot authorize replay.
Choose the right evaluation profile
These reuse components but are not one interchangeable installation.
| Profile | Working capability | Qualification boundary |
|---|---|---|
| Synthetic browser walkthrough | Requester, reviewer and viewer roles; exact-action confirmation; filtered/paged history | Java/PostgreSQL/browser tests and rendered UI checks, using a test-only IdP |
| Codex approval rehearsal | Authenticated MCP request/status/explicit-resume plus separate browser review | Named Codex 0.162.1 / gpt-5.6-sol rehearsal on 2026-10-15, not arbitrary clients or models |
| Native endpoint read/block demo | Request-bound source proof and policy before simulated read or destructive denial | A separate named CLI profile, not the bearer-only approval MCP profile |
| Buildable operator archive | Java runtime libraries and built inbox, private configuration, offline check and strict database startup | Needs Java 21, local PostgreSQL and approved OIDC configuration; no universal external-provider or fresh-laptop claim |
Start with the clean Mac walkthrough, or read the recorded model-driven approval proof. That manual record reports returned states, not an independently captured target-call count. Automated claim/concurrency tests are separate evidence.
More than the happy path
| Safeguard | What is implemented | Important limit |
|---|---|---|
| Identity dependency failures | Bounded/coalesced key refresh, bounded DNS/wait resources, late-result and expiry rejection | Local-instance resource controls, not provider fairness or distributed public abuse protection |
| Approval listener admission | Fixed active lanes, bounded pending task queue, transport refusal on overflow, bounded close | Not TCP/byte limits, a guaranteed JSON saturation response or a graceful drain |
| Uncertain completion | One bounded attempt to record unknown after a completion-write failure; consumed authority is not restored | Persistent outage can leave executing; no automatic target retry or abandoned-attempt sweep |
| Operator recovery | Read-only aggregate inspection and one-way declared quarantine of new durable authority | Not automatic old-backup detection, cancellation of committed work or permission to resume |
See browser/history flow, package startup, and inspection/quarantine. The capability baseline and task-specific runbooks distinguish implementation, automated tests, named live qualification and future scope. Passing one profile does not qualify another.
What is not being claimed
No real AWS/Jira executor, universal agent interception, host-wide anti-bypass, public production gateway, independently signed release, production latency SLO or complete recovery/upgrade product is shipped by this preview. A fresh machine and a selected external provider still need their own recorded qualification. See deployment and operations before choosing a profile.