Advisory-first

This is the claim most often got wrong about Vectadyne, and it is got wrong in both directions. Both errors are damaging, so this page states each one plainly.

The rule

preflight.action and context.assemble return a verdict. A verdict is an answer, not an intervention. It arrives in time to be useful and it does not stop your agent.

A block verdict becomes an actual gate in exactly one place: the CI/PR check you explicitly opt into.

Error 1: overclaiming

“Vectadyne blocks unsafe actions.”

It does not. Nothing in the inline path stops an agent from applying a patch, force-pushing or running a migration. If your agent ignores a block verdict, the action happens.

This is the more damaging error, because it sells an enforcement guarantee that does not exist. If you need a hard stop on a code path, the stop has to be your branch — or the CI check, which is a gate because the CI system enforces it, not because Vectadyne does.

Why build it this way? An inline enforcement layer in an agent loop is a single point of failure that turns every control-plane hiccup into a stalled agent, and it puts a network round trip on the critical path of every action. Advisory-first inverts that: an outage degrades your information, never your availability. See Degraded mode.

Error 2: underclaiming

“So Vectadyne enforces nothing.”

Also wrong, and nearly as bad — it undersells the security model and leads people to build compensating controls they do not need.

Tenancy, scope pinning, clearance and capability are enforced server-side on every single request. A caller reaching outside its authority is refused, not advised:

• A token for tenant A cannot read tenant B’s memory. Not “is advised not to” — cannot.
• A principal scoped to repo:payments cannot read repo:infra.
• A clearance that would widen a principal’s authority is rejected outright, not silently clamped to something safe.
• A principal without a capability cannot call the verb that needs it.

These are refusals with fault codes — forbidden, unauthenticated — and no verdict is involved.

The precise statement

Advisory-first describes what happens to a risky action the caller is otherwise authorized to take.

Authorization is settled first and hard, on the server. Then, within what you are allowed to do, Vectadyne tells you what it knows about the thing you are about to do and leaves the decision with you.

What this means for your code

The verdict is information; the branch is yours:

guidance = interpret(verdict)
if guidance.holds:        # block / require_approval / unrecognised
    stop, and surface the reasons
else:
    act — with the advisories in front of the model

Two properties every SDK guarantees:

• A warn never holds. It is advice: something the corpus knows that your agent did not. Surface it; do not obey it. An integration that stops on warn has rebuilt the inline gate.
• An unrecognised decision holds. A vocabulary a client cannot interpret is not one it may ignore, so all three SDKs fail closed there.

The polarity of that check is inverted between our SDKs — Go and TypeScript expose hold, Python exposes proceed. See Interpret a verdict.

The honest limit

The limit. Vectadyne cannot stop an agent that ignores it. An agent that never calls preflight.action, or calls it and discards the answer, is entirely ungoverned.

What still holds. Everything about authority is still enforced: that agent cannot read outside its scope or write outside its capability, and every call it does make is in the audit trail.

What to do about it. Put the branch in the loop, test that you asked rather than trusting that you did, and turn on the CI/PR gate for the irreversible actions where you want a real stop.