neti cloud

A confirm has to reach somebody.

On one machine there is nobody to ask, so the gate stops the call — correct, and the end of the story. The hosted tier is where the question goes: to a person, through whatever your organisation already uses to reach one.

Back to neti

Two routes, one decision.

A pending approval carries the magnitude, the ceiling it crossed, and the policy digest it was judged under. How it reaches a human is yours to choose — and it is always a human who answers.

Route one · automated delivery

A webhook, into what you already run

The control plane posts the pending approval wherever your team already looks — Slack, Teams, PagerDuty, an internal tool. No new inbox, and the on-call rotation you already trust decides who sees it.

# the payload carries evidence, never your arguments
{
  "digest":    "a7f3…",
  "tool":      "remove_group_members",
  "magnitude": 41203,
  "unit":      "principals",
  "ceiling":   200,
  "expires_at": "…"
}

Route two · the console

A screen, for the person who answers

One call waiting, showing what it would touch against the ceiling that stopped it, with Deny and Approve. The grant is bound to that exact call under that exact policy, single-use, expiring — and refused if the target has grown since they looked.

# the agent, meanwhile
approval a_b271… is pending;
retry this exact call once it
is granted.

Where Claude fits, and where it does not.

This is the screen, working. Press Ask Claude and see what a reviewer gets instead of a number — then notice that the briefing changed what you know and nothing about what happens.

Claude is very good at the part around the decision. It is deliberately not the part that decides.

1 approval waiting remove_group_members expires in 4:52

magnitude: 41,203 principals
ceiling: 200
verdict: confirm
session: s_9f21c4
agent: offboarding-bot
policy digest: a7f3e0…

Reads the six fields above. Nothing else.

Claude stops here

Only these two change what happens, and only a person can reach them.

Claude does Everything above that line — read the pending approval and say what it means, and draft the reason that goes into the record, so the audit trail says why a human said yes rather than only that they did.

Claude does Narrow the call, on the agent's side. Handed a number instead of a refusal, it retries with a smaller target — which is the whole reason the denial sentence carries the magnitude.

Claude does not Grant the approval. A control plane may only ever make a decision more permissive, and only through a named human. A model in that seat would be a model deciding to widen a blast radius, which is the one thing this product is built to prevent.

This is the point, not a limitation. The gate's verdict is a static comparison against a number a person committed, sealed into a chain that re-derives offline. Putting a model in the approval path would make the strongest sentence neti has — 0 models in the decision path — untrue, and it is the sentence a security reviewer checks first.

The line is one question.

Can one machine do this? If yes, it is Apache-2.0 and free forever. Enforcement runs on one machine, so blocking is free. A second person answering does not, so it is not.

Every paid item is a hole SCOPE.md already documents, or work that exists only because more than one person did it.

Free — Apache-2.0, today

The engine, all fifteen seams, observe and enforce
Every resolver, and the record chain
The console, every screen
Budgets over a session, a day, a week or a rolling window
No telemetry, no phone-home, no licence check

Cloud

A second human answering a confirm
Webhook delivery into Slack, Teams or your own system
One org policy, signed and pinned by digest
Budgets pooled across the fleet, not per laptop
Audit across every agent, anchored in one place

Paying adds no availability risk to enforcement. Unreachable, absent or unpaid behaves exactly as a free install — a control plane can only widen a decision, never narrow one. That is a test in the repository, not a promise on a page. And the client is already open: read the protocol, write your own server, hold it to the same tests.

Talk to us.

Tell us how many agents you are running and what you want a human to see before it happens. If the free tier already covers you, we will say so.

Read the source