# How gnt works

An agent dropped into your company doesn't know your refund window, your compliance boundaries, or
which actions need a human standing in the loop. Tell it once and it might follow that instruction.
It might also paraphrase it, forget it under load, or decide a different action makes more sense in
the moment, and nothing stops it either way. gnt exists to close both gaps, giving an agent your
actual rules and stopping it from acting outside them regardless of what it decides.

## Two halves

**`skill.md` is knowledge.** Rules approved in your org get compiled into `SKILL.md` files an agent
reads, `gnt pull` fetches, or `search_rules`/`get_rule` return on demand. This is retrieval; it tells
an agent what the policy is. Like any prompt content, an agent can read it, reason about it, and still
act against it.

**`check_action` is enforcement.** It checks a described action against your approved rules before
the action runs, outside the model's own reasoning, as a separate call with a separate verdict, not
something the model can talk itself out of. This is what actually stops an action nobody approved.

Neither half does the other's job. `skill.md` can't stop anything; `check_action` doesn't try to make
an agent smarter, just to catch it before a bad action lands.

## The handbook problem

A rule inside an AI's prompt is like an employee handbook: the employee can read it, agree with it,
and still act against it in the moment, because nothing physically stops them. What actually stops
unauthorized action isn't the handbook, it's not having the login credentials, a hard gate the action
has to pass through regardless of intent.

gnt is the credentials, not the handbook. `skill.md` is the handbook (what an agent reads).
`check_action` is what makes it real (what actually stops it).

## What happens on a denial

`check_action` returns one of three immutable verdicts (`allowed`, `blocked`, or `needs_human`) plus
the org posture's separate `enforcement_action`. On `blocked`, the action is stopped before it
executes, full stop. The verdict comes back from gnt, not from the
model reconsidering, so it happens outside the model's own decision process, and a hook or wrapper
enforces it regardless of what the model would have chosen to do next.

```text
$ check_action("refund order #8021, placed 90 days ago")

{"verdict": "blocked",
  "enforcement_action": "block",
  "reason": "Refunds are store-credit only after 30 days",
  "cited_rules": [{"id": "8f2c…", "title": "Refund window"}],
  "rules_retrieved": 3}
```

See [Enforce](/docs/enforce) for how to wire that verdict into a hook so a `blocked` call can't be
skipped by the model choosing to ignore it.

## How rules get approved

Rules are approved once, upfront, not per action. A human reviews a proposed rule and merges it, the
same as reviewing a pull request, before it's ever available to an agent. `gnt prebrain` drafts rules
from your own tools; anything else, a webhook, Slack's `/brain`, a rule typed by hand, goes through
`gnt review` the same way. See [Sources](/docs/sources) for how rules get proposed.

After that merge, every matching action is checked automatically, at machine speed, with no human in
the loop per action. A human approves the rule once; `check_action` applies it every time after that,
without waiting for anyone.