Pre-write verifier · FlowRail Docs

Tier 1: local pattern hard-deny

Runs on your machine, no network call. Catches the well-known shapes of high-confidence secrets: Stripe live keys, AWS access keys, GitHub tokens. If a write contains one of these, the commit is hard-blocked and Claude is told what kind of secret was matched (never the value itself). This tier keeps working even when the network is down or a prompt-injection has thrown the model off course.

Tier 2: single-model semantic verifier

The default path for ordinary writes. The pre-write hook sends the new content over HTTPS to api.flowrail.ai, where a single model evaluates it against the active review's threats and returns a verdict the agent acts on. It catches the long tail Tier 1 can't reach by shape: JWT-shaped tokens, connection strings, env vars accidentally inlined, code that writes outside the feature's declared scope, content that would leak system data.

Tier 3: multi-model consensus on high-risk (v1)

This tier lands in v1; today every verification is single-model, including on high-risk surfaces. In v1, for the surfaces SPEC §5.3 names as high-risk (auth, crypto, payments), two models run the same check in parallel; a third is added when the first two disagree. Hard-block requires unanimity. Soft-block fires on majority, and the agent gets the verdicts and retries with the patch. Customers can opt-out per guardrail in flowrail.yaml; opt-out is logged.

Quorum tablev0.4.2

tier         models  hard-block            soft-block       cost
─────────────────────────────────────────────────────────────────────
tier-1       n/a     pattern match         n/a              ~ms
tier-2       1       deny verdict          n/a              1×
tier-3 · v1  2 → 3   unanimous (2/2)       majority (2/3)   2-3×

Guardrails todayv0.4.2

no-secrets-in-code                   # JWT shapes, conn strings, env-var inlining
agentic-no-scope-escalation          # writes outside the feature surface
agentic-no-system-data-in-shared-content   # infra metadata leakage
no-destructive-infra-operations      # destructive infra operations in writes
app-security-authz                   # application authorization weaknesses
no-broken-access-control             # request-time IDOR/BOLA, fail-open auth
no-csv-formula-injection             # CWE-1236 spreadsheet formula injection
no-unsafe-file-upload                # CWE-434 unrestricted upload handling
no-unvalidated-outbound-request      # CWE-918 SSRF-shaped outbound requests

# all nine run on every verification; per-threat-category selection is v1

Wire flowv0.4.2

Claude Code  ── Write/Edit ──▶  pre-write hook (local)
                                 │
                                 ├─ tier 1: regex hard-deny
                                 │   └─ match → exit 2 (no LLM call)
                                 │
                                 ├─ tier 2: server verify (api.flowrail.ai)
                                 │   └─ verdict → permissionDecision
                                 │
                                 └─ tier 3: server consensus (high-risk only) · v1
                                     └─ 2-of-2 unanimous = hard-block
                                         2-of-3 majority  = soft-block

What happens when one fires

Hard-block: write denied; Claude receives the verdicts with a suggested fix; the agent patches and retries via the verify skill. Soft-block: write allowed but the agent is informed of the dissent so it can choose to revise. Only when the tiers can't resolve the situation does it surface to you.