Action control guides · Production-agent control stack
The control stack puts a decision before every production change.
Changing identity and cloud settings safely requires a chain from the failing control to the connected system and back to a durable receipt.
Runtime and identity
The runtime starts the agent for a failing control and carries its identity and owner into each tool request.
- Evidence
- Control, agent, owner, and request
Connection and action policy
The connector exposes the supported tool. Deixic checks the requested change and target against policy before the call reaches that tool.
- Decision
- Allow, refuse, or require named approval
Approval and execution
A gated change waits. Approval releases the accepted call; denial closes it without touching the system.
- Evidence
- Approver, decision, time, and supporting material
Read-back and receipt
Deixic reads each changed setting back, uploads the evidence to your compliance platform, and re-runs the test there. The receipt, the recorded cost, and the decision stay in activity history for fleet and audit review.
- Operations
- Status, spend, decisions, and receipts
Reuse the fix the next time the control fails.
Activity history records each fix and the authority behind it. Save a repeated fix as a skill and replay real sessions when the method changes.
See compliance executionSee the execution path