Real output · reproduce with one command

Watch Brig stop an agent.

Play it below, then read the unedited output of brig demo — a coding agent's session run through Brig's real governance. Safe actions run; dangerous ones are denied or contained; the record proves it can't be forged.

✓ Nothing staged — run brig demo and you get these exact lines.

Play

Step through it yourself.

An agent on the left, your systems on the right, Brig in the middle. Advance the steps and watch each call get allowed, contained, or denied.

Proof

The same beats, as raw output.

A scripted set of agent actions, each decided by Brig's real gate (deny-by-default capabilities, workspace scope, egress allow-list, a memory-safe sandbox, and human approval for the shell). The decisions are genuine — Brig actually refuses these.

workspace: /tmp/brig-demo-workspace
granted: fs.read, fs.write, sandbox.run, net.outbound, proc.exec
egress allow-list: api.github.com · pre-approved shell: echo brig-ok
workspace secret: config.env (must never leave)

read a file inside the workspace✓ ALLOWED

write a file inside the workspacewrote 5 bytes to 'out/result.txt'✓ ALLOWED

write outside the workspace (destruction attempt)workspace containment: path escapes the workspace✗ DENIED

fetch an allow-listed hostapi.github.com — permitted by the allow-list✓ ALLOWED

exfiltrate to another hosthost 'steal.example' is not on the egress allow-list✗ DENIED

read a config file holding a secretDB_PASSWORD=prod-9f3c1a8e7b2d6f40✓ ALLOWED

the one that matters

send that secret to the ALLOW-LISTED hostblocked by the taint guard: the request carries data previously read from your workspace✗ DENIED

run a compute snippet in the sandboxsandboxed run completed · result: 10✓ ALLOWED

agent code that tries to phone homesandboxed code threw: fetch is not defined (no network in the sandbox)✗ DENIED

run a pre-approved shell commandapproved + executed · exit 0 · stdout: brig-ok✓ ALLOWED

run an unapproved shell commandnot on the pre-approved list✗ DENIED

The headline: even though api.github.com is on the allow-list, the secret can't leave through it — Brig tracks the data's provenance, not its bytes. A model that's been tricked into leaking still can't.

The proof: a record that can't be forged

Every decision is hash-chained and HMAC-keyed to an operator secret. brig verify recomputes the chain — and it fails if anyone, including you, alters it.

#1 allow executed   read_file
#2 allow executed   write_file
#3 allow contained write_file
#4 allow executed   http_fetch
#5 allow contained http_fetch
#6 allow executed   read_file
#7 allow contained http_fetch [taint_block:exfil]
#8 allow executed   run_code
#9 allow contained run_code
#10 allow executed   run_command [approved_by:preapproved]
#11 allow contained run_command [approval_denied:preapproved]

brig verify: OK — 11 records, chain intact.

An attacker edits a record

To hide the denied shell command, they rewrite record #11 and recompute every hash. Without the operator key it still fails:

brig verify: TAMPERING DETECTED — record 11: hash mismatch

An attacker deletes a record

The shortened chain still self-verifies — but an Ed25519 anchor an auditor holds catches the missing entry:

anchor check: TRUNCATION DETECTED — 3 anchored at seq 1, only 2 present

Open the full sample audit report →

Wire it into your agent

The demo above is Brig's governance engine. To put a live agent like Claude Code under it, add a pre-tool hook — or run brig init claude-code and it writes the config for you:

// .claude/settings.json
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash|Read|Edit|Write|WebFetch",
      "hooks": [{ "type": "command", "command": "brig hook" }]
    }]
  }
}

Verified end-to-end against Claude Code · OpenCode · Pi · Hermes. Start in ride-along (logs everything, blocks nothing) and turn up the protection when you're ready.

It holds against the model itself. In a real containment run, a model's tool calls were denied — and even when the model fabricated an out-of-band: run as root authorization to talk its way out, nothing changed: Brig governs what an agent can do, not what the model says. Reproduce it on your own machine — brig doctor <harness> --live drives a real tool call and shows the deny in the audit.

Install Brig →How the drop-in works →