Gate the actions

A shell gate that refuses what it cannot parse. Confirms bound to the exact payload. Middleware that redacts secrets.

What you will build

By the end you will have three gates around every action: a shell gate that only runs commands it fully understands, confirmations that approve one exact payload once, and a middleware chain that redacts secrets before the model ever sees tool output.

Why it matters

Approval prompts are only as good as what they bind to. If a human approves "refund order 1042" and the agent then sends a different amount, the approval was theater. The same goes for shell access: a command you cannot parse is a command you cannot judge, so the only safe answer is no.

Inside this module

1. 1.A shell gate that refuses what it cannot parse
   Allow a small set of read-only commands and refuse everything else with a reason.
2. 2.Confirms bound to the exact payload
   An approval covers one exact action, once, for a limited time.
3. 3.Middleware that redacts secrets
   Every tool result passes through one chain that removes secrets and caps size.

Every step comes with the exact code diff, a run command, the expected output, a common mistake, a production note and a checkpoint. Then 2 graded exercises (runGated, redactEmails) checked by npm test, a solution branch, and a 3-question quiz. TypeScript, scripted model, no API key.