How It Works

OpenLatch is a runtime control plane deployed inside every AI agent, organized as three layers: capture on the agent host, the cloud control plane, and the verdict returned to the agent.

Architecture Overview

AI Agent → Client (local) → Control Plane → Verdict → Allow / Enforce

Today the client captures and forwards events and fails open — it does not block. The enforcement core that produces verdicts is being rebuilt; the flow below is the architecture it restores.

Layer 1: Hook

The OpenLatch client installs lightweight hooks into your AI agent’s tool call pipeline. When an agent attempts an action — writing a file, running a shell command, making a network request — the hook intercepts it before execution.

What gets intercepted:

• File system operations (create, write, delete)
• Shell command execution
• Network requests
• Environment variable access

What does NOT get intercepted:

• Code generation (text output from the agent)
• Read-only operations (file reads, directory listings)
• Agent-to-user communication

Layer 2: Control Plane

Intercepted actions are forwarded to the OpenLatch control plane. The payload includes action metadata — not your source code.

The control plane is built to evaluate each action against:

• Known malicious patterns (e.g., reverse shells, credential exfiltration)
• Anomaly detection (unusual behavior for the current session context)
• Policy rules (configurable per-organization)

Layer 3: Verdict

Each action receives a verdict:

Verdict	Meaning
Allow	Action is safe — the agent proceeds normally
Block	Threat detected — action is prevented, agent receives an error
Flag	Suspicious but not blocked — logged for review

Fail-Open Design

If the control plane is unreachable (network outage, timeout), OpenLatch allows the action to proceed. This is a deliberate design choice:

• Developer productivity is never blocked by infrastructure issues
• The client logs bypassed actions for later review
• Timeout threshold is configurable (default: 500ms)

Privacy

OpenLatch sends action metadata to the cloud, not your source code:

• Command strings (e.g., rm -rf /)
• File paths being written to
• Network destinations
• Session context (agent type, project hash)

File contents, source code, and environment variables are never transmitted.