What happens when Kastra denies a shell command?

On a deny decision, the shell command never reaches the downstream system. Kastra returns a structured denial with the policy id, the rule that fired, and the reason. The attempt is recorded in the evidence vault with the full request context and cryptographic proof of the decision.