Unverified50% confidenceDecision RuleExact time
In the tool.check hook, the current branch is checked, and if the push target is the main branch it is rejected outright, even if the permission rules themselves allow this push.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/15/2026
First Seen
Valid until: 1/13/2027
Sources
Related Entities
Related Claims
UnverifiedGoal模式在每一次工具调用之前都会做校验，通过工具调用拦截层将调用意图与预设约束比对，从而杜绝越界操作68% similarUnverifiedThe pre-tool-call check must be executed inline at the tool boundary—meaning the decision is made before the call, not after the result is returned.67% similarUnverifiedThe pattern of intercepting at tool boundaries embeds security checks into the tool-call execution path, making it equally effective against unauthorized or runaway Agents.66% similarUnverifiedIn Agent anomaly detection, it is recommended to assign a reversibility level to each action according to tool type, and set independent abort thresholds for different levels, rather than using the same score for the entire trajectory.66% similarUnverifiedBefore a tool is executed, the system must at minimum check four things: whether the tool exists, whether the parameters are valid, whether the current identity has permission, and whether the operation is within the scope permitted by the task.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1037074API
curl https://kongchang.com/api/v1/knowledge/claims/1037074MCP
get_claim(id=1037074)