Kosenko says signing a CLA should be a deny rule

Vladimir Kosenko of Octomind told Matt Van Horn that an agent signing a CLA, a contributor license agreement, is a legal act and should be blocked by a rule rather than left to a model. His framing is that the same request can land differently depending on which model is behind the tool call, so the result is not a policy at all. In his own agent, he says a deny rule matches the tool call itself and fires before anything runs.

Vladimir Kosenko · Octomind

@web3brightside

X

One model refuses, a stripped one signs, and neither is a policy.

Vladimir Kosenko · Octomind

@web3brightside

X

In my agent a deny rule matches the tool call itself and fires before anything runs.

The argument

The distinction he is drawing is between two places a refusal can live. One is inside the model, where a classifier or a router looks at the action and decides whether it is allowed. The other is in the harness, where a rule matches the tool call by name and stops execution before the model's opinion matters. Kosenko's claim is that the first option gives you variance where you wanted a guarantee, because a stricter model and a stripped down one will not agree on the same legal action.

Van Horn's reply to the thread was a shrug emoticon, so this is one builder's position rather than a debate anybody won.

What is not here

No numbers. Nobody posted a model versus model comparison on the same CLA decision, no refusal rate, no sample of actions where a screening call went the wrong way. Kosenko is describing how he built his agent and why, not reporting a measurement. Treat it as a design opinion from someone who has shipped the pattern, not as evidence that model based screening fails on legal actions.

For people building on it, the line Kosenko is drawing is narrower than it first reads. He is not arguing against screening agent actions with a model in general, which is the same job Composio Firewall does at runtime. He is arguing that a small set of actions with legal consequences should never reach that layer, because a probabilistic yes is the wrong shape of answer for a signature. If you are deciding how much of your action gating to hang on a model call, the question his post raises is which of your tools you would want to be unable to call at all.