10110010011101001011001101101110101018200.devFrom Enterprise.Systems
Start free

Active prevention

8200.dev starts detective — it observes, explains and scores. Active Prevention lets the engines also act: remove a public link, revoke a risky share, downgrade access, suspend a rogue agent, or revoke an agent's scope.

Acting is gated, reversible and honest. Detective coverage is live today; preventive writes require explicit write-scope OAuth, are simulated by default, and the real vendor write is the final founder-gated step.

Detective vs preventive

Detective enforcement — observe, explain, produce a verdict — is live now across every connector. Preventive enforcement acts at the vendor and is opt-in per connector: enabling prevention sets the per-connector opt-in (and, in mock mode, simulates the elevated write-scope grant so the whole loop is demo-able today).

Five remediation actions

Every proposal maps to one of five action types, each carrying its preconditions, the exact vendor API call it would make, and the prior state it records for undo:

  • Remove public link — strip an anonymous or public-web share.
  • Revoke share — remove a specific external or guest grant.
  • Downgrade access — reduce an over-broad permission (for example, editor → viewer).
  • Suspend principal — disable a rogue or compromised identity.
  • Revoke agent scope — withdraw an AI agent's or app's over-broad consent.

The four remediation levels

You choose how far 8200.dev goes to fix a finding. Set an org-wide default and override it per rule in Security Policies. The levels form a strict ladder — each adds capability and, with it, blast radius.

8200.dev is read-only by default. Write access comes only from a separate grant you approve — per repository for Fix-PR, per connector for Auto — and never from the core monitoring connection.

  1. 1Notify (all plans) — an alert plus a remediation playbook. Nothing is changed. This is the default.
  2. 2Guided fix (paid plans) — the exact commands, a direct link to the provider settings for that resource, and the steps. You run them on your side; no write access is needed.
  3. 3Fix-PR (Business and up) — 8200.dev opens a remediating pull request in your repository; a human reviews and merges it. Nothing changes without approval, and it needs a separate, revocable, per-repo write grant.
  4. 4Auto (Business and up) — for the rules you choose, 8200.dev applies the fix automatically under the existing auto-guard safeguards (kill-switch, allowlist, per-connector opt-in).

Manual vs AUTO-GUARD

Manual remediation is one click: Simulate always, Execute with explicit confirmation when prevention is live. AUTO-GUARD optionally auto-acts on high-confidence, deterministic violations only — it is off by default and available on the Business tier and above.

AUTO-GUARD is fail-closed by design: a model-only verdict can never trigger an auto-execute, only a conservative allowlist of action types is eligible, and a global kill-switch beats every gate and degrades all enforcement to simulate-only.

Simulated until granted

Until write-scope OAuth is granted and assessed, every action runs in simulate mode and is labelled as such — nothing claims a live vendor change it did not make. Mock-connector enforcement is real and reversible against the demo graph, badged as demo data.

Every action — simulated or live — writes a full, reversible audit trail: who, what, when, before → after, and result.