Nothing executes because the agent "decided to." Every tool call is intercepted before it runs, evaluated against explicit policy, and given one of three verdicts. The record is sealed whichever way it goes — including the calls that never happened.
The call satisfied every applicable rule — scope, authority, data boundary, autonomy cap. It executes exactly as requested, and the receipt records what evidence and which rules allowed it.
The call is consequential enough that policy requires a human in the loop. It waits; the approver's identity and decision become part of the sealed record. Delegation with an audit trail, not delegation on faith.
The call violated policy and never executed. The attempt itself is still sealed — a blocked action you can prove was blocked is a control; a blocked action with no record is a rumor. See one in the live tool-call demo.
The gate does not look for reasons to stop a call — it requires reasons to allow one. A call that matches no rule fails closed. That inversion is what makes the receipt chain meaningful: silence is never consent.
Each receipt records which policy version evaluated the call. When rules change, old receipts still replay against the rules that were in force — same inputs · same policy · same verdict. See Deterministic Replay.