Skip to main content
Shell Command Controls let your team deny shell commands run by AI coding agents. You can ban a command or block specific invocations with patterns matched against each parsed command’s text. Corridor’s agent hooks enforce the rules on the developer’s machine before a command runs.
Shell Command Controls are part of Agent Governance and are available on the Enterprise plan. Enforcement supports Cursor, Claude Code, Factory Droid, OpenAI Codex, and Devin Desktop through Hooks.

​
How it works

  1. Intercept the command: Corridor’s hook runs when an AI agent attempts a shell command.
  2. Parse the command: Corridor splits the command line into individual commands, including compound commands (a && b), pipelines, subshells, and loops.
  3. Evaluate the rules: Corridor checks each command against your team’s rules. If any command matches, the entire invocation is blocked.
  4. Return the decision: A blocked command does not run. The agent receives a policy message so it can take another approach.
When Agent Telemetry is enabled, the Agent Timeline also records shell commands run by agents.

​
Rule types

Rules apply to an executable name, such as git or terraform. Each command can have one of these rule types: Commands without a rule are always allowed; there is no allow-list mode. Patterns use RE2 regular-expression syntax, which does not support lookahead or backreferences. Corridor validates patterns when you save them, so you cannot save a pattern that a device cannot enforce. For compound commands, such as rm -rf build && git push --force, a match on either command blocks the entire invocation. Rules cannot target the Corridor CLI.

​
Managing rules

Open Governance → Shell Controls in the Corridor dashboard. The page lists commands observed across your team’s agents and commands added manually. Summary cards show the number of controlled commands, active patterns, and observed commands without rules. Expand a command to toggle a ban or create patterns. Corridor suggests rules based on risky commands observed across your team. Suggestions are advisory and are never applied automatically. Select Review to open a suggestion in the rule editor.

​
Roles

​
Enforcement details

  • Rules are enforced on the developer’s device by the same Corridor hook that powers MCP compliance. No network request is required when a command runs.
  • Cursor and Claude Code fetch rules at session start. All supported agents refresh them about every 15 minutes, so rule changes reach devices within minutes without a reinstall.
  • If a device cannot reach Corridor, it continues to enforce its last-synced rules for up to 7 days. Corridor then discards the stale policy and stops enforcement until the device can sync again, allowing development to continue rather than enforcing stale rules.
When a command is blocked, the agent receives a message like:

​
A guardrail, not a sandbox

Shell Command Controls can stop a cooperating agent from running a destructive cleanup, force-push, or risky deployment command, while creating an audit trail. They do not create a security boundary against a compromised agent or motivated user because enforcement runs inside the agent’s environment.
  • Commands the parser cannot decompose fail open and run.
  • Heavily wrapped, obfuscated, or dynamically constructed commands may not match a pattern written for the plain command.
  • Commands are not evaluated if they run outside the agent’s tool-call path or on a machine where Corridor’s hooks have been removed.
Agent Telemetry provides a server-side record of commands that enforcement could not block.

​
Next steps

MCP Tool Controls

Allow or block MCP servers and individual tools

Agent Telemetry

See commands in the Agent Timeline