Every save is a version
Each save is a new version, logged in the audit log. Agents pick up the change on their next hook call.
Rules and approvals
Your rules.
Your sign-off.
Protect the paths that matter, pick what warns and what blocks, and choose who can wave a block through. Out of the box, Comity warns rather than blocks.
How it works
Set them once for the org, adjust them per repo, and keep a person on every block.
Protect what only some people should touch. Give a path like infra/** its owners. Anyone else's agent that edits there is blocked, and with fail closed it stays locked even when Comity can't be reached.
Protected paths →
Choose what warns and what blocks. Set how serious each kind of overlap is. The org default covers every repo, and a repo override changes only the rules it sets.
Every policy rule →
A person signs off on every block. Only the roles you allow can override, owners and admins by default, with a reason that's stored encrypted and kept in the audit log. Anyone else can request one.
Overrides →
The details
How policies combine, change and reach every agent.
Require an intent first
Set require_intent to required, and an agent has to say what it's working on before it edits.
If Comity is unreachable
Agents keep working by default. Choose Block edits to pause writes until Comity answers again.
Ignore the noise
Leave generated files, lockfiles and build output out of every check with ignore_paths.
Slack for what matters
Blocks, blocked edits, work requests and autopilot recaps post by default. Tune the list and the minimum severity.
Team decisions for the rest
"Postgres, not Mongo" is a team decision, with its own warn or block mode and the same override roles.