CueCruxVaultCrux

Ask

Ask the documentation

The same 133 chapters, indexed as the docs corpus. Scores, coverage and gaps are computed from the corpus, not decorated, and if the answer is not in here, the page says so instead of guessing.

corpus docs coverage 0.45 no gaps949 tokens6 passages

This documentation does not cover that. Coverage 0.45. Nothing below is an answer; these are the closest passages, shown so you can judge the gap yourself.

  1. [1]Shield SecurityIt does not enforce anything in observe mode.** This is the default. Nothing is blocked; everything is recorded. It does not enforce approvals just because it is in enforce mode.** Approval gating is a separate switch and can be off while the mode is on. It does not enforce at… 0.68docs · 495 tokopen chapter →
  2. [2]Citation-Credit Modelplatform.tip credit.conversion credit.policy.updated bundle.purchase.cross_tenant shield.decision shield.trust.changed shield.approval.requested shield.approval.resolved shield.taint.blocked shield.sandbox.violation shield.kill_switch.toggled 0.67docs · 61 tokopen chapter →
  3. [3]Shield SecurityShield sits between an agent and the things it can change, and answers one question per call: allow, refuse, or stop and ask a human.** Every answer is recorded with an identifier you can quote later. This page is explanation and reference: what Shield is for, what each part o… 0.60docs · 96 tokopen chapter →
  4. [4]Shield SecurityShield administration itself is a set of tenant-scoped routes under /v1/shield/. A request whose credential carries no tenant gets 401 AuthMissing; a request naming a tenant that disagrees with its credential gets 403 Forbidden with Tenant mismatch for shield request, the mism… 0.60docs · 140 tokopen chapter →
  5. [5]Shield SecurityBe clear about the boundary here. **Shield enforces the label; it does not compute it.** The caller supplies the taint label. Shield's guarantee is that a declared label is honoured consistently, recorded, and cannot be overridden by the tool. It is not a guarantee that untrus… 0.60docs · 107 tokopen chapter →
  6. [6]Shield SecurityShield is the control plane that decides whether an agent's tool call or mutation is allowed to run: capability classes, taint labels, a trust registry, human approvals and kill switches, with an expl 0.58docs · 50 tokopen chapter →

Retrieval runs in your browser over the bundled corpus. Reading and questions stay on this machine. Read the document · follow a trail.