Gates
Every action gate and code gate Asondy ships, grouped by what it protects.
Action gates and code gates
Asondy has two kinds of gate:
- Action gates
- Read each command, file edit or tool call before it runs, and stop a risky one, such as deleting files, a force push or reading secrets.
- Code gates
- Read the code the agent wrote at push, in CI and on the server. The push waits until they pass.
Every gate can be turned off on the dashboard Gates page; Data gate is set on the Sensitive data page.
The dashboard counts two kinds of stop:
- Action gate denial
- A command stopped before it runs, like
git push origin main. - Code gate block
- Code held back because a code gate failed, like a failing test or a leaked key.
Where they run
- Session
- Action gates run at the coding tool's hooks: prompts, commands, file edits and tool results.
- Push
- Code gates run on the diff before code leaves the machine.
- Verify
- Code gates run when the work is verified.
- Submission
- Code gates run on the server, where remote checking is on.
- Directive
- Code gates run when the goal and its instructions are read.
Action gates
Commands & git
| Gate | What it checks | Runs at |
|---|---|---|
| Dependency install | Asks before a risky package install. | Commands |
| Token use | Tells an agent when a large context, a long wait, a slow rerun with nothing changed or a vague brief wastes tokens. It never stops the call. | Tool calls |
| Destructive commands | Denies destructive commands and force pushes. | Commands |
| Gate | Runs the code gates before a push. | Commands |
| Merge | Denies merges while checks are red. | Commands |
| Piped shell | Denies remote scripts piped into a shell. | Commands |
| Prepush | Scans each push for secrets. | Commands |
| Push main | Denies pushes to the default branch. | Commands |
| One-way doors | Asks before one-way actions like a publish. | Tool calls |
| Persistence | Flags writes that outlive the session. | Tool calls |
Secrets
| Gate | What it checks | Runs at |
|---|---|---|
| Data gate | Redacts or blocks sensitive data. | Prompts, Tool calls, Tool results |
| Secret scan | Blocks secrets in prompts and tool traffic. | Prompts, Tool calls, Tool results |
| Credential stores | Denies reads of your credential stores. | Tool calls |
| Credential taint | Denies sending secrets after a credential read. | Tool calls |
Untrusted input
| Gate | What it checks | Runs at |
|---|---|---|
| Output taint | Holds network calls after an injection. | Prompts, Tool calls, Tool results |
| Outside taint | Marks the session when web or MCP content arrives. | Prompts, Tool results |
| Hook audit | Flags risky hooks at session start. | Session start |
| Repo surface | Warns when a repo can run code or send data. | Session start |
| MCP health | Pauses an MCP server that keeps failing. | Tool calls, Tool results |
| Output gate | Warns on prompt injection in tool output. | Tool results |
Edits
| Gate | What it checks | Runs at |
|---|---|---|
| Self protect | Stops an agent turning off the action gates. | Tool calls |
| Switch file | Stops an agent writing gate switch files. | Tool calls |
| First touch | Reads a sensitive file before its first edit. | Prompts, Tool calls |
| Dedup read | Skips rereading an unchanged file. | File reads |
| Diff edit | Turns a near-identical rewrite into an edit. | File edits |
| No fallback | Denies edits that keep a fallback path. | File edits |
| UI & UX | Denies UI edits that break the UI & UX gates. | File edits |
| Edit freeze | Keeps edits inside the frozen folder. | Tool calls |
| Project rules | Runs your rules from .asondy/rules. | Tool calls |
Session
| Gate | What it checks | Runs at |
|---|---|---|
| Model | Keeps review roles off the weakest model. | Agent starts |
| Orchestrator | Warns when a tool result floods the context. | Tool results |
| Stop | Holds an /asondy run open until checks report. | Reply end |
| Intake log | Logs each prompt to the run. | Prompts |
| Owner bootstrap | Links the session to your dashboard. | Session start |
| Session restore | Restores run state after compaction. | Session start |
| Precompact | Saves run state before compaction. | Compaction |
| Postmerge cleanup | Lists leftover branches after a merge. | Tool results |
| Session start | Finds the session owner and its state folder. | Session start |
Code gates
Code quality
| Gate | What it checks | Runs at |
|---|---|---|
| Complexity | Flags changed functions that are too complex. | Push, Submission |
| CRAP | Flags complex changed functions by a CRAP score, weighted by the share of their lines a test ran; with no test run it scores at zero coverage. | Push, Submission |
| YAGNI | Flags code with no caller and no need. | Push |
| Unreachable | Flags code no path can reach. | Push, Submission |
| Duplication | Flags copy-pasted logic inside the diff. | Push |
| Said once | Flags a sentence said twice, or one fact kept in two docs. | Verify |
| Types | Type-checks the changed TypeScript. | Push |
| Imports | Fails when changed-file imports don't resolve. | Push |
| Path references | Flags a path or link in a doc or config that points at nothing. | Verify |
| Cycles | Denies new import cycles. | Push |
| Fail-fast | Requires failures to surface, never pass silently. | Push, Submission |
| Edit syntax | Checks supported JavaScript and JSON files for syntax errors. | Submission |
| Negative assertion | Flags a predicate change with no test for the negative outcome. | Verify |
| Single anchor site | Flags a second derivation of an anchor outside the one place that owns it. | Verify |
| Verification freshness | Flags a touched feature with no recipe that verifies it. | Verify |
| Setup break | Flags a renamed environment variable, port, path or script that no doc names. | Verify |
| Validator weakening | Flags a diff that makes a validation rule more permissive. | Verify |
| Lint config weakening | Flags a diff that loosens lint configuration. | Verify |
| Never cut | Flags a diff that deletes gate code. | Verify |
| Risky logic test | Flags new risky logic that ships with no test. | Verify |
| Plan review focus | Flags a multi-step plan with no Review-Focus failure list. | Verify |
| Debt ledger | Flags a debt marker with no limit and no owner path. | Verify |
| Hedges | Flags a hedge with no evidence beside it. | Verify |
| Size | Enforces change-size discipline. | Push, Submission |
| Dry run | Fails when a script that accepts a dry-run flag still changes something under it. | Verify |
| Placeholder | Flags placeholder code shipped as real. | Submission |
| Code slop | Flags sloppy patterns inside the diff. | Push |
| Infrastructure YAGNI | Allows one process per container and no process managers. | Verify |
| Debug residue | Fails an added debugger statement, and console.log or print left in library code. | Verify |
| Test quality | Flags hollow tests that assert nothing. | Push, Submission |
| Test edit | Flags weakened or deleted tests. | Verify |
| Fails on base | Flags a fix whose test already passed before the fix, or fails after it. | Verify |
| AI writing | Catches signs-of-AI prose in public text. | Push, Submission |
| Comment verbosity | Flags comment bloat and narrated noise. | Push, Verify, Submission |
| Migration safety | Blocks a schema change that renames, drops or locks a table in one deploy, unless its expand and contract steps ship apart. | Push, Verify |
Security
| Gate | What it checks | Runs at |
|---|---|---|
| Secret scan | Blocks pushes when configured secret scans detect exposed credentials. | Push |
| OWASP LLM | Flags the LLM risk classes. | Directive |
| Exfil | Blocks exfiltration patterns in changed code. | Push, Verify, Submission |
| Insecure code | Flags code execution sinks in added lines, with Semgrep where installed. | Verify |
| Dark patterns | Flags pre-ticked consent, rating-gated reviews, fake urgency, shaming and inflated sales claims. | Push, Verify |
| Dependency sources | Blocks a pushed dependency that comes from outside the official registries. | Push |
| Anti-pattern | Denies known-bad structural patterns. | Push, Submission |
| AI code patterns | Denies AI-typical bug classes: tmp names, TOCTOU, non-atomic writes. | Push, Submission |
| Commit identity | Refuses a pushed commit that is unsigned, co-authored or not authored by the repo owner. | Push, Verify |
| Hook bypass | Refuses hook bypass advice in added lines. | Push, Verify, Submission |
| CI runner policy | Allows a CI runner you host only from an allowlist, never on production. | Push |
| Lockfile sync | Flags a dependency changed without its lockfile. | Verify |
| Workflow security | Flags PR-head checkout, untrusted text in run steps, unpinned actions and write-all tokens. | Verify |
| Container hardening | Flags privileged or host-namespace containers, socket mounts and a root user. | Verify |
| Unsafe sinks | Flags unsafe deserialization, verification turned off, XXE and weak-random secrets. | Verify |
UI & UX
| Gate | What it checks | Runs at |
|---|---|---|
| Site trust | Flags made-up testimonials and unbacked trust claims, and a site that collects data or sells without privacy and terms pages. | Push, Verify |
| ARIA patterns | Flags an unknown ARIA role or attribute, a combobox or dialog missing its parts, a control screen readers skip but Tab still reaches and an unnamed Flutter icon or image. | Push, Verify |
| Rendered accessibility | Opens the served pages in a browser with changed pages first. It flags axe-core findings and keyboard traps, along with invisible focus, sideways scrolling at 320 px and motion that ignores reduced motion. | Verify |
| Generated UI specs | Flags an A2UI message or json-render spec with an unknown component, a dangling child id or an unnamed control, and an MCP App resource served as text/html+mcp, with a wildcard CSP domain or a ui/resourceUri key. | Push, Verify |
| UI tells | Flags a removed focus ring, placeholder-only labels, small targets and other generated-UI tells. | Push, Verify |
| DESIGN.md tokens | Flags colors, corners, type and spacing outside the repo's DESIGN.md. | Push, Verify |
Understand enforcement coverage
An action gate can only block where the coding tool exposes a hook. Claude Code has every hook; other tools have fewer. See the integration coverage.
Respond to a failed check
- Read the check name and the condition that failed.
- Fix the code or configuration it names.
- Rerun the check on the current revision.
Data gate
Data gate watches model traffic for sensitive data. It runs in three modes: off lets everything through, monitor records findings but allows the traffic, enforce blocks or redacts it. If the scanner itself fails, the failure mode decides: open lets traffic through, closed stops it.
Company profiles hold hashes of internal terms, never the terms themselves. Only the org owner can change the mode or manage profiles, from the Sensitive data page in the dashboard, which also lists recent findings.
Questions
Can Asondy stop an AI coding agent from running rm -rf?
Yes, in Claude Code. The Destructive commands gate reads each shell command before it runs and denies rm -rf or find -delete aimed outside the worktree and its scratch folders. It also denies git reset --hard, git clean -f and force pushes. It follows variables set in the same command, so D=build; rm -rf $D is judged by the folder it names, a target it cannot resolve is denied, and text that only mentions rm -rf, such as a commit message, is not treated as a command.
Can Asondy stop an agent from pushing to main?
Yes. The Push main gate denies git push to the remote's default branch, including a bare git push while main is checked out and a gh api call that writes the main branch ref. It denies the push when it cannot rule main out. Keep branch protection on in your repository too: the action gate works inside the coding session, and the repository decides what can merge.
What happens when an agent deletes, skips or weakens tests to make them pass?
The Test edit gate flags it. It compares JavaScript and TypeScript test files with the base branch and reports a deleted test file, an added .skip, xit or .only, an early return planted in a test and a net loss of assertions. Test files in other languages are named as unread rather than passed. The Test quality gate flags tests that assert nothing.
Can Asondy stop an agent from piping a download into a shell?
Yes. The Piped shell gate denies a download piped into bash or sh, process substitution such as bash <(curl ...) and eval over a download. Saving the script to a file first, so it can be read before it runs, is allowed.
Does Asondy stop an agent from committing API keys?
The Secret scan runs before every push and blocks the push when it finds an exposed credential. It uses gitleaks or trufflehog when one is installed and a built-in pattern scan otherwise. With the cloud connected, Data gate can also record or block sensitive data in prompts and tool traffic.
How do Asondy gates use Claude Code hooks?
Asondy installs Claude Code hooks. PreToolUse hooks read each shell command, file edit and web call before it runs and answer with a deny decision and a reason the agent reads, so a denied command never runs. A Stop hook holds completion until every pass cites a recorded result. The push, merge and destructive-command gates fail closed: if one hangs or crashes, the command is denied rather than allowed.
How is Asondy different from a hook I write myself?
A short hook script usually matches text such as rm -rf, which misses quoted, chained or variable-built commands and refuses harmless mentions. Asondy parses the command, follows cd and git -C to the repository a push acts on, and denies when it cannot rule a push to main out. Its gates also run at push, merge and done.
Is Asondy a sandbox?
No. Action gates check commands and code at the points the coding tool exposes, and they run with your own permissions. They do not isolate the agent from your files or network. Keep operating-system permissions, branch protection and CI in place, and use a sandbox when you need isolation.
References
- OWASP Top 10 for LLM Applications, OWASP GenAI Security Project
- Gitleaks secret scanner, Gitleaks
- TruffleHog secret scanner, Truffle Security
- About protected branches, GitHub Docs