What Chock doesn't stop

Guards add friction, and some tricks get past them

Chock's guards are deterministic scripts that match patterns. Chock's own docs call them best-effort friction, not a security boundary: quoting tricks, aliases and new encodings can get past a pattern-based guard. Chock does not stop every attack. It closes common, known entry points before they ship.

Sources, at the pinned engine commit:

• docs/baseline-policies.md
• docs/assurance-case.md
• README.md

Agents with no hook, or not wired

Chock can stop an action in the agent only where the agent runs a hook that chock wired. If chock has set up no hook for an agent, that agent sees only advisory text. Its commits and pushes still go through chock's git hooks and CI gate, where those are installed. These agents have no install method, or lack one of the two. The reason comes from the engine:

Sources, at the pinned engine commit:

• docs/assurance-case.md

Agents that let the action through when a hook fails

On some agents, if a hook crashes, times out or never loads, the tool call runs anyway. So a silent hook looks exactly like a protected session. Agentseam's tier data records what each agent does when a hook fails. On these agents, a hook that fails before a tool runs lets the tool run. chock doctor checks that each agent's hooks are in place and running.

See: Troubleshooting

Sources, at the pinned engine commit:

• docs/assurance-case.md
• README.md

Hook timeouts

When a client's hook timeout runs out, the agent stops waiting for the hook and the command runs. Chock writes a timeout above its own 30-second budget into each hook entry it writes, so its own limits fire first and ask or deny. Windsurf's hook entry has no timeout key, so Windsurf's own default applies, and it is not documented. Each agent's page lists its timeout.

See: Agents

Sources, at the pinned engine commit:

• docs/enforcement-surfaces.md

Writes checked only at turn end

Some agents record no file-writing tool that chock's write hook can match. There, a policy that checks file contents does not check the write itself: it reads what the turn left on disk when the turn ends. The file is on disk until then. Counts from each agent's labels in the pinned catalog:

Sources, at the pinned engine commit:

• src/chock/plugin/bundle_grade.py
• src/chock/plugin/gate_package.py

Git hooks: --no-verify and fresh clones

git commit --no-verify skips every git hook, and so every chock gate. block-no-verify refuses the flag before the command runs, but only on agents with wired hooks. Git hooks live in .git/hooks, which is not cloned, so a fresh clone enforces nothing until someone runs chock sync. The CI gate closes both gaps, but it is not automatic: chock sync --ci writes it.

Sources, at the pinned engine commit:

• SECURITY.md

A person's CHOCK_ALLOW

A gate with action: ask cannot prompt at commit or push, so it refuses there. A person lets that one command through by running it with CHOCK_ALLOW=<policy-id>. This is not honoured for an agent's commit, and in CI an ask is a warning.

Chock tells an agent's commit from a person's by environment variables. CHOCK_AGENT_COMMIT=0 unsets that one variable and clears no vendor marker. An agent could set it too. A person commits from their own shell, which has none of the markers. The guards on the agent's own commands are the separate backstop.

Sources, at the pinned engine commit:

• docs/enforcement-surfaces.md

The observe rollout level

rollout: observe in .chock/config.yaml turns a compiled gate's block or ask into a warning, and rollout: ask caps it at ask. The action goes through, and the log records what chock would have blocked. Command guards, tool_call gates, the MCP gateway and a script hook's own exit 1 still block. An agent cannot lower the level for itself: it is held to the level committed in HEAD, or a stricter one, and CHOCK_ROLLOUT counts only for a person's own commit or push.

Sources, at the pinned engine commit:

• CHANGELOG.md
• src/chock/gate/runner/actor.py

A guardrail turned off: chock bundle off

With the plugin, chock bundle off <id> switches one member of the plugin off. The off applies from the next session, not the current one. At repo scope it applies only once .chock/guardrails.json is committed. The member stays off until you switch it back on.

See: Configure

Sources, at the pinned engine commit:

• docs/custom-policies.md

A policy disabled: chock disable

With repo hooks, chock disable <id> adds the policy to policies.disabled in .chock/config.yaml, recompiles the rest, and removes its git-hook wiring. chock disable refuses a policy marked mandatory: true.

Sources, at the pinned engine commit:

• docs/cli-reference.md

Processes already running

Chock checks at fixed points: before a tool call, at a turn's end, at commit, at push and in CI. It does not watch an agent afterwards. Once a process is running, such as a background shell or a server the agent started, chock does not check it again.

Sources, at the pinned engine commit:

• docs/agentic-risk-coverage.md

Credentials

Chock does not manage agent identity, tokens or spend budgets. Identity platforms and gateways own runtime credentials, and chock's gateway hook point claims nothing for them today. A policy such as scan-secrets refuses a credential written into a change. It does nothing about a credential the agent already holds.

Sources, at the pinned engine commit:

• docs/agentic-risk-coverage.md

What each policy misses

Each policy's page has a "What it misses" section. Across policies, the same kinds come back: aliases, quoting and shells a guard does not parse, and values that are split, encoded or built at run time. Advisory policies block nothing.

24 of the 71 policies in the pinned catalog carry the label advisory on Claude Code: rule text the agent reads, and may not follow.

Policies whose catalog entry lists what it misses:

• Block Agents Started With Safety Off
• Block Curl Piped to Shell
• Block Files That Skip Git Hooks
• Block Persistence and Publishing Commands
• Block Reading Stored Credentials
• Block Skipping Git Hooks
• Block Wildcard Agent Permissions
• CI GitHub Actions Security
• Dockerfile and Compose Security
• Protect Agent Config
• Review Cloud Identity Switches
• Review Values That Look Like Secrets
• Scan Agent Permission Settings
• Scan Secret Files
• Scan Secrets
• Verify MCP Allowlist

Sources, at the pinned engine commit:

• docs/baseline-policies.md
• README.md

What Chock sends

Chock sends nothing over the network when it enforces. Each check is a deterministic script, with no model call and no network access at enforcement time.

Sources, at the pinned engine commit:

• README.md