Your agents need a dynamic sandbox.Read the blog post →

Policy demo
Catch an agent retrying a denied action

When an agent is blocked from doing something, it often tries again a different way. Qpoint looks at the recent history of the session to tell when a new action is really a workaround for something that was just blocked. In the demo, an agent that can’t comment on GitHub through its MCP server tries the GitHub CLI instead, and Qpoint catches it.
Gaurav Mahajan
Gaurav Mahajan
November 3, 2026

About this demo

When an agent’s action is denied, it rarely stops there. It tries the same goal another way: a CLI instead of an MCP server, a script instead of a direct file read. Each attempt looks fine on its own, so a rule that checks one action at a time won’t catch it.

In this demo, a static Qpoint rule keeps GitHub read-only for agents by denying the GitHub MCP server’s write tools. A second rule asks a judge model whether a command uses a different tool to do what a recently denied call tried to do, with the session’s last 30 events as context. This rule starts in flag mode: the action goes through but is marked in the audit log.

We ask Claude Code to comment on a GitHub issue, and the MCP write is denied. We ask it to use the GitHub CLI instead, and the judge flags it as a workaround. We switch the rule to deny and try again, and this time the CLI comment is blocked. Nothing in the policy mentions the CLI.

See Qpoint in action in your environment
Request access and we'll get you set up.
Request Access