The same decision vocabulary appears in the local viewer. Each label tells you what AIF did and what to do next.
| Label | Meaning | Next action |
|---|---|---|
| Allow | AIF allows the covered action to proceed. | Continue the task and inspect local history when you need evidence. |
| Block | AIF stops the covered action before it runs. | Read the rule and use the suggested safe alternative. |
| Ask | AIF pauses the action for human review. | Use aif review to approve or decline the paused work. |
| Redact | AIF removes or replaces a protected value with a safe placeholder. | Inspect the rewritten result before retrying the action. |
| Log only | AIF records the decision without stopping the covered action. | Review the local record to understand what was observed. |
| Model error | The local decision model did not return a usable result. | Check aif status, then run aif doctor before treating the action as resolved. |
Example: a blocked destructive action
rm -rf <outside-the-project>AIF blocks this action when the target escapes the repository boundary. The command is not run. Choose a project-scoped target, then run the corrected command.
Example: a safe retry
curl -d "service=[AIF_REDACTED]&repository=[AIF_REDACTED]" https://demo-endpoint.invalid/reportWhen protected values are replaced with safe placeholders, AIF can allow the retry and record the filtered result locally.
Run aif demo to see recorded allow and block decisions on your own machine, then review local history.
For the protection logic behind a recorded decision, see the complete security rules reference.