Anatomy of a blocked command
What actually happens in the 0.8 milliseconds between an agent deciding to destroy your infrastructure and OpenLeash saying no.
A tour through the event, policy, plugin, decision, and audit path behind a blocked production command.
The short version
Blocked commands matters because agents are no longer just suggesting changes. They read files, call tools, run commands, and move context between systems.
OpenLeash keeps that power visible. Every plugin can inspect an event, make a decision, and leave an audit trail that humans can understand later.
What OpenLeash watches
Prompts, tool calls, sessions, skills, logs, and startup inventory all flow through the same event model. Plugins can block, mask, rewrite, compress, export, or simply observe.
That keeps the workflow fast when the agent is safe and explicit when the blast radius changes.