An agent can take ten individually allowed actions whose combination is the leak, and no per-call filter can see it. polyman sits between the agent and its tools, tracks what the session has already touched, and refuses the one call that would complete the leak. Enforcement, not advice — the policy it enforces is the one polysec checked on every path before it shipped, and nothing on its decision path can be talked into the wrong answer.
In July 2026 Noma Labs showed GitHub Agentic Workflows leaking a private repository: an injected instruction in a public issue, a private read the agent was entitled to make, and a public comment. Every call was individually allowed — the coexistence was the leak. The full case is on the polysec page.
Every agent framework now ships a tool-approval hook to sit in front of exactly this. They share one weakness: the policy inside the hook is a hand-written if, and nobody checked that it holds on every reachable combination of tool calls. That is the gap polyman is built to close.
A gate that cannot be talked out of its job. polyman steps the checked policy before every call — nothing runs first — and when the next call would put the session into a state it must never reach, that call fails. The agent sees an ordinary failed call; the journal sees which rule, and why.
What polyman holds the agent to at runtime is the same mandate polysec checked before the run — there is no second policy to drift out of sync. No model or network call sits on the decision path, so the thing deciding whether a call runs cannot itself be talked into the wrong answer.
ifAdapted from “Your Agent Is Lying to You,” Jean-Jacques Dubray.