SHRIKERecovery path
A recovery path is the way back that ships with a refusal: when a governance layer holds or blocks an agent action, it also returns the reason and the next legitimate step, so the agent or its operator can correct course instead of retrying, guessing, or abandoning the task.
A refusal without a recovery path is a dead end, and dead ends are where agents either give up on real work or start probing for a way around the gate. Shrike returns a recovery block on every scan, allowed or refused, naming the reason and the action that would clear it: refresh a lapsed scope, ask a person, change the approach. Each refuse tier has a matching control on the dashboard, including releasing a locked session and, under a live scope, a bounded and audited self-release by the agent's own key. The principle is that every refusal ships with its recovery control.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Start with what is action governance or the quickstart.