Before Rewind is ever needed:
every agent action independently judged first.

// .claude/settings.json — the hook fires before Bash, Write, Edit and any MCP tool
{ "hooks": { "PreToolUse": [ { "matcher": "Bash|Write|Edit|mcp__.*",
      "hooks": [ { "type": "command", "command": "veridect-pre-tool-use", "timeout": 60 } ] } ] } }

#!/usr/bin/env bash
# veridect-pre-tool-use — reads the tool call on stdin; exit 2 = the tool does not run
set -euo pipefail
IN=$(cat)
BODY=$(jq -cn --argjson in "$IN" --arg scope "$VERIDECT_AGENT_SCOPE" '{
  action: ($in.tool_name | sub("^mcp__[^_]+__"; "")),            # mcp__rubrik__rerun_backup_job → rerun_backup_job
  target: ("claude-code:" + ($in.cwd // "repo")),
  parameters: $in.tool_input,
  callingAgent: ("claude-code:" + $in.session_id),
  callingAgentScope: $scope,                                      # its configured authority, in words
  department: "engineering" }')
RES=$(curl -fsS --max-time 60 -H "Authorization: Bearer $VERIDECT_API_KEY" -H 'Content-Type: application/json' \
  -d "$BODY" https://<your-veridect-host>/api/ai/consensus/pre-action) || RES='{}'   # -f: any non-2xx is "unavailable", never a verdict
VERDICT=$(jq -r '.verdict // "unavailable"' <<<"$RES"); RECORD=$(jq -r '.auditBundleId // ""' <<<"$RES")
if [ "$VERDICT" != "greenlight" ]; then
  echo "Not executed — Veridect $VERDICT · record $RECORD" >&2   # the agent sees why; the refusal is on the ledger
  exit 2                                                 # closed until proven open
fi

# rsc_gate.py — the only path from an agent to a Rubrik Security Cloud mutation
import os, httpx
VERIDECT = "https://<your-veridect-host>/api/ai/consensus/pre-action"
RSC      = "https://<your-account>.my.rubrik.com/api/graphql"          # the agent never holds this token

MUTATIONS = {                                                           # the only operations this proxy will ever send — pinned here, never supplied by the caller
    "delete_snapshot":   "mutation DeleteSnapshot($snapshotFid: UUID!) { deleteSnapshot(input: {snapshotFid: $snapshotFid}) { success } }",
    "rerun_backup_job":  "mutation TakeOnDemandSnapshot($input: TakeOnDemandSnapshotInput!) { takeOnDemandSnapshot(input: $input) { success } }",
    "export_snapshot":   "mutation ExportSnapshot($input: ExportSnapshotInput!) { exportSnapshot(input: $input) { id } }",
}
AGENT_AUTHORITY = {                                                     # authority keyed by the agent's identity — your configuration, never a request field
    "spiffe://prod/agents/backup-operator": "may re-run backup jobs and adjust SLA assignments within the standard tier; may not delete snapshots or export data",
    "spiffe://prod/agents/report-summarizer": "read-only: may read job status, SLA compliance and event history; may not modify any Rubrik object",
}

def governed_mutation(caller_identity: str, action: str, variables: dict) -> dict:
    """caller_identity = the identity your service verified on the inbound call (mTLS / OIDC) — not a body field."""
    scope = AGENT_AUTHORITY.get(caller_identity); mutation = MUTATIONS.get(action)
    if scope is None or mutation is None:
        return {"executed": False, "verdict": "unknown_agent_or_action", "record_id": ""}   # never asked, never run
    verdict, record_id = "unavailable", ""                              # closed until proven open
    try:
        r = httpx.post(VERIDECT, timeout=60,
                       headers={"Authorization": f"Bearer {os.environ['VERIDECT_API_KEY']}"},
                       json={"action": action, "target": "rubrik:" + action.split("_", 1)[-1],
                             "parameters": variables, "callingAgent": caller_identity,
                             "callingAgentScope": scope,                     # its configured authority, in words
                             "department": "data_protection"})
        if r.status_code == 200:
            d = r.json(); verdict = d.get("verdict", "unavailable"); record_id = d.get("auditBundleId", "")
    except Exception:
        pass                                                            # network, timeout, parse: all stay closed
    if verdict != "greenlight":
        return {"executed": False, "verdict": verdict, "record_id": record_id}   # the mutation never leaves this process
    out = httpx.post(RSC, timeout=60,
                     headers={"Authorization": f"Bearer {os.environ['RSC_SERVICE_TOKEN']}"},
                     json={"query": mutation, "variables": variables})
    body = out.json() if out.status_code == 200 else {}
    ok = out.status_code == 200 and not body.get("errors")                      # GraphQL answers 200 with "errors": read them
    return {"executed": ok, "verdict": "greenlight", "record_id": record_id, "rsc": body}

# 1) once — register the real tool server as an upstream (admin call)
POST /api/ai/consensus/mcp/upstreams/{tenant}
{ "upstreamId": "rubrik-tools-prod", "url": "https://<your-tool-server>/mcp", "enabled": true }

# 2) the one change — the MCP server URL in the agent's configuration
before:  https://<your-tool-server>/mcp
after:   https://<your-veridect-host>/api/mcp/gateway/rubrik-tools-prod

# Claude Code — .mcp.json, unchanged except for the URL
{ "mcpServers": { "rubrik": { "type": "http",
    "url": "https://<your-veridect-host>/api/mcp/gateway/rubrik-tools-prod",
    "headers": { "Authorization": "Bearer <VERIDECT_API_KEY>",                # your Veridect tenant
                 "X-Upstream-Authorization": "Bearer <tool-server token>" } } } }  # forwarded to the tool server

# 3) what the agent sees on a greenlight: the upstream's own result, plus
#    result._meta["veridect/verdict"] and result._meta["veridect/bundleId"]
#    on escalate / block: a JSON-RPC error (-32003 / -32004) carrying the
#    verdict and the record id — and the tool server never receives the call.