The app decides.
The model does not.
Allow, Ask or Block is enforced by Cryonic, outside the model. If Cryonic is absent, broken or silent, the action does not happen.
Three answers, set per action and per agent.
Allow
The action runs without asking.
Ask
The action waits for your answer. Asks wait in the Cryonic daemon; the default timeout is 3600 seconds, and you can change it.
Block
The action is refused.
Sample data
How it is enforced. The gate sits outside the model, per provider.
Claude Code
Cryonic starts Claude Code with a gate that runs before every tool call. If the gate fails in any way, the tool is refused. Agents never run in bypass mode.
Probed with a tool call that writes a file.
Codex
By default Cryonic drives Codex through its app server. Commands, file changes and permission requests wait for Cryonic’s reply. Declined means the command never runs, and the read-only sandbox holds on its own even if an approval is given. Any request Cryonic does not recognise is refused.
A second Codex mode with no per-action approval. Cryonic refuses to start it when an agent has any Ask or Block rule, or when the sandbox is full access, and logs each run as “sandbox only”.
A second layer
A system prompt hardens agents against basic prompt injection. It reduces the risk and does not remove it. The app’s enforcement is what must hold if the model is fooled.
Proof for sensitive approvals
Payments, first, and other proof-required approvals need a secret or passkey held on the device. They are click-only: no key on the keyboard approves them. From a phone, the passkey is checked on the PC.
A log you can verify
Every decision logs the agent, exact detail, rule, who decided, provider session and time. Secrets are redacted first. Rows are hash-chained, so cryonic log --verify shows tampering. It cannot prevent tampering by a process with your rights.
What this does not stop.
Cryonic repeats this list in the app. None of it is hidden.
- Agents run as your Windows user. A rule on the command git push cannot see inside a script the agent wrote. For a hard stop, set run_commands to Ask.
- On Windows, Claude Code has no OS sandbox under Cryonic. Only Codex has one, and its unelevated mode has weaker network isolation.
- A separate low-rights Windows account for agents would be the real fix. It is not in v0.1.
- The system prompt reduces prompt injection. It cannot stop it.
- Any process running with your rights can reach Cryonic’s control pipe. Tested for real: an agent with only run_commands set to Allow started a process outside its Job Object through WMI, and that process approved another agent’s pending Ask.
- cryonic approve --secret puts the secret on the command line, where process listings can show it. The app passes it over the pipe instead.
- Codex in its untrusted mode may auto-run commands on its own safe list without asking. Cryonic logs and alerts on them but cannot refuse them.
Join the waitlist.
Leave an email and you will hear when Cryonic is ready.