How gnt works

An agent dropped into your company doesn't know your refund window, your compliance boundaries, or which actions need a human standing in the loop. Tell it once and it might follow that instruction. It might also paraphrase it, forget it under load, or decide a different action makes more sense in the moment, and nothing stops it either way. gnt exists to close both gaps, giving an agent your actual rules and stopping it from acting outside them regardless of what it decides.

Two halves

skill.md is knowledge. Rules approved in your org get compiled into SKILL.md files an agent reads, gnt pull fetches, or search_rules/get_rule return on demand. This is retrieval; it tells an agent what the policy is. Like any prompt content, an agent can read it, reason about it, and still act against it.

check_action is enforcement. It checks a described action against your approved rules before the action runs, outside the model's own reasoning, as a separate call with a separate verdict, not something the model can talk itself out of. This is what actually stops an action nobody approved.

Neither half does the other's job. skill.md can't stop anything; check_action doesn't try to make an agent smarter, just to catch it before a bad action lands.

The handbook problem

A rule inside an AI's prompt is like an employee handbook: the employee can read it, agree with it, and still act against it in the moment, because nothing physically stops them. What actually stops unauthorized action isn't the handbook, it's not having the login credentials, a hard gate the action has to pass through regardless of intent.

gnt is the credentials, not the handbook. skill.md is the handbook (what an agent reads). check_action is what makes it real (what actually stops it).

What happens on a denial

check_action returns one of three immutable verdicts (allowed, blocked, or needs_human) plus the org posture's separate enforcement_action. On blocked, the action is stopped before it executes, full stop. The verdict comes back from gnt, not from the model reconsidering, so it happens outside the model's own decision process, and a hook or wrapper enforces it regardless of what the model would have chosen to do next.

Code
$ check_action("refund order #8021, placed 90 days ago")

{"verdict": "blocked",
  "enforcement_action": "block",
  "reason": "Refunds are store-credit only after 30 days",
  "cited_rules": [{"id": "8f2c…", "title": "Refund window"}],
  "rules_retrieved": 3}

See Enforce for how to wire that verdict into a hook so a blocked call can't be skipped by the model choosing to ignore it.

How rules get approved

Rules are approved once, upfront, not per action. A human reviews a proposed rule and merges it, the same as reviewing a pull request, before it's ever available to an agent. gnt prebrain drafts rules from your own tools; anything else, a webhook, Slack's /brain, a rule typed by hand, goes through gnt review the same way. See Sources for how rules get proposed.

After that merge, every matching action is checked automatically, at machine speed, with no human in the loop per action. A human approves the rule once; check_action applies it every time after that, without waiting for anyone.