Acting as operations@arctransformationgroup.com (configured, not authenticated)

API http://127.0.0.1:8787 ok v2.1.0

← All evidence

Evidence arc_ev_f2ae802853dbce3478d7ea56cefdc22c

engineering-agent requested github.create_issue · agents may not write to a protected branch

denied DENY

What happened

  1. Requested 09:18:27.107Z
    engineering-agent → github.create_issue
  2. Decided +0.118 ms
    DENY GITHUB-002 v1 · no-default-branch
    agents may not write to a protected branch
  3. Approval (no data)
    not required
  4. Executed (no data)
    not executed: denied
Environment
production
Owner
platform@example.com
Tool
write · medium · github
Credential
arc_cred_ab2e4d6cf3cc9b2b2eb99aff7c74f28d

Parameters

Recorded parameters
repository arctransformationgroup/platform
title Hotfix: bypass the approval queue
branch main

Decision trace

Every rule the engine examined, in order. The evidence record stores a digest of this trace, so a tampered trace is detectable without duplicating it.

Decision trace: every rule the engine examined, in order
Policy Rule Result Effect
GITHUB-002 v1 no-default-branch matched DENY

Obligations

None

Integrity

integrityDigest
over every field above
sha256:211a23215d3bef79cc06518895dff3d8111f80aeba092e291371084f2d255239
parametersDigest
sha256:1d0f4510ca560241240725ce8795b1b9cca838c3bed1d9eff6ac516e2b6cdd0e
traceDigest
sha256:d7a2d1351f40161aa52eed22cb91cf39091fede5f7ee1ef7f354e040853bd766
Raw record (JSON) 
{
  "id": "arc_ev_f2ae802853dbce3478d7ea56cefdc22c",
  "schemaVersion": 1,
  "actionId": "arc_act_a695e8287120d4625d32f77b912c5e1d",
  "organizationId": "default",
  "environment": "production",
  "agent": {
    "id": "arc_ag_c92e58dc46afacd2726b9a4dad1e3fdd",
    "name": "engineering-agent",
    "owner": "platform@example.com",
    "roles": [
      "engineering"
    ],
    "credentialId": "arc_cred_ab2e4d6cf3cc9b2b2eb99aff7c74f28d"
  },
  "tool": {
    "name": "github.create_issue",
    "system": "github",
    "effect": "write",
    "riskTier": "medium",
    "connector": "simulation"
  },
  "request": {
    "parameters": {
      "repository": "arctransformationgroup/platform",
      "title": "Hotfix: bypass the approval queue",
      "branch": "main"
    },
    "parametersDigest": "sha256:1d0f4510ca560241240725ce8795b1b9cca838c3bed1d9eff6ac516e2b6cdd0e",
    "requestedAt": "2026-10-26T09:18:27.107Z"
  },
  "decision": {
    "id": "arc_dec_25dbe200cba3399b2d71c9618d78eaae",
    "effect": "DENY",
    "policyId": "GITHUB-002",
    "policyVersion": 1,
    "ruleId": "no-default-branch",
    "reason": "agents may not write to a protected branch",
    "decidedAt": "2026-10-26T09:18:27.107Z",
    "evaluationMs": 0.117547,
    "traceDigest": "sha256:d7a2d1351f40161aa52eed22cb91cf39091fede5f7ee1ef7f354e040853bd766"
  },
  "risk": {
    "class": "sensitive",
    "reversibility": "compensable",
    "sensitive": true,
    "factors": [
      {
        "code": "tool_risk_tier",
        "detail": "the tool is registered at risk tier \"medium\"",
        "escalation": 1
      },
      {
        "code": "production_environment",
        "detail": "the action targets the \"production\" environment",
        "escalation": 1
      }
    ],
    "classifierVersion": 1
  },
  "outcome": "denied",
  "obligations": [],
  "createdAt": "2026-10-26T09:18:27.107Z",
  "integrityDigest": "sha256:211a23215d3bef79cc06518895dff3d8111f80aeba092e291371084f2d255239"
}
Raw decision trace (JSON) 
[
  {
    "policyId": "GITHUB-002",
    "policyVersion": 1,
    "ruleId": "no-default-branch",
    "matched": true,
    "effect": "DENY",
    "reason": "agents may not write to a protected branch"
  }
]