What the gate does before anything runs.
An agent proposes a command. VIRP classifies it against a per-vendor grammar, not a pattern match on a string, and the classification decides what happens next. Every outcome is signed and chained, including the ones where nothing ran.
The four dispositions
| Disposition | What happens | What gets signed |
|---|---|---|
| GREEN | executes | the command and the device's response |
| YELLOW | stops and produces a proposal; executes only after an enrolled approver signs it | the proposal, the approval, and the outcome, linked |
| RED | stops and produces a proposal, same as YELLOW, at a higher ceiling; one enrolled-approver signature releases it, and quorum approval is a roadmap item | the proposal, the approval or the rejection, and the outcome |
| BLACK | never transmitted, never proposable, never approvable | the refusal and its reason |
Where the gate enforces, and where it does not
The network drivers run the gate in enforce mode: a classification that says stop, stops. The linux and wazuh drivers are published as running under a per-driver shadow override, where the gate records the decision it would have made and the command still reaches the driver. Forbidden operations are refused in either mode, by the driver itself. We state the exception here rather than let “every command is checked” carry weight it has not earned on every driver.
Approval
A YELLOW or RED operation produces a proposal, and nothing runs until a person with an enrolled key signs it. RED is the higher ceiling, not a refusal: it uses the same mechanism, one enrolled-approver signature releases it today, and m-of-n quorum is a roadmap item rather than shipped behaviour. The signature covers the exact command, the device, and a short expiry, and it is single-use. The daemon re-verifies all of that at execution and refuses if anything moved. So the record answers both directions: the agent cannot deny what it ran, and the operator cannot deny authorizing it.
Per-identity limits
Each identity that reaches the gate has its own ceiling. An automation account and a remote agent are not the same principal and do not get the same reach, even for the same command.
A refusal, signed
What the absence of an approval means
GREEN operations execute without a proposal. So the absence of an approval in the record is not evidence that nothing happened; it is evidence that nothing needed one. Reports state which operations required approval and which did not.
The gate is not what we sell. It is why the evidence is worth reading.