How Styx keeps coding agents away from production

Coding agents run as you, with your logged-in CLIs. How Styx puts a person between them and production: shims, a session-bound broker, a pure policy function, expiring grants, OS authentication and a hash-chained audit log. And where it stops.