# AI use cases for Docker (decionis/docker)

Repo: [decionis/docker](https://github.com/decionis/docker) | Use cases: 5 | Page: https://dedupedai.com/use-cases/decionis-docker/

Decionis for Docker is an integration surface that puts a deterministic authority check and optional human approval between an AI agent's intent and consequential actions, with signed decision records.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Hold production deploys until a human approves: https://dedupedai.com/use-cases/decionis-docker/hold-production-deploys-for-human-approval/
- Gate privileged MCP tool calls behind authorization: https://dedupedai.com/use-cases/decionis-docker/gate-privileged-mcp-tool-calls/
- Watch agent authority decisions in Docker Desktop: https://dedupedai.com/use-cases/decionis-docker/watch-governed-agent-activity-in-docker-desktop/
- Keep signed Decision Dossiers for audit trails: https://dedupedai.com/use-cases/decionis-docker/produce-signed-decision-records-for-audits/
- Ship execution governance inside Dev Containers: https://dedupedai.com/use-cases/decionis-docker/add-execution-governance-to-dev-containers/

## How to hold production deploys until a human approves with Docker

Repo: [decionis/docker](https://github.com/decionis/docker) | Difficulty: Advanced | Time: 2 hours | Basis: From the README

Route an agent's production deployment through policy so a HOLD waits for verified Presence approval.

**Who it is for:** Platform engineer whose AI coding agent sometimes proposes production infrastructure changes.

**The problem:** An agent can run terraform apply or similar commands in production with no check on whether a human should have signed off.

**The outcome:** Production changes run only after policy returns PROCEED, with a human approval recorded for any HOLD.

### Steps

1. Define a policy that marks production infrastructure changes as requiring human authority.
2. Connect the agent's deployment tool calls so each proposed action is sent to Decionis before execution.
3. When Decionis returns HOLD, have the authorized approver complete Presence verification such as a passkey or trusted-device approval.
4. Confirm the verdict changes to PROCEED before the downstream system runs the change.
5. Keep the resulting Decision Dossier for the deployment record.

### Prompt to paste into your agent

```text
Using the decionis/docker repository, send a proposed action named terraform.apply with environment production for <target stack> to Decionis before running it. Expected output: a verdict of PROCEED, HOLD, or BLOCK with a policy name and reason codes. Verify that execution does not start unless the verdict is PROCEED after any Presence approval.
```

### Caveat

The README says Decionis does not execute the action, so your downstream system must still wait for a PROCEED verdict before it runs the change.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/decionis-docker/hold-production-deploys-for-human-approval/

## How to gate privileged MCP tool calls behind authorization with Docker

Repo: [decionis/docker](https://github.com/decionis/docker) | Difficulty: Advanced | Time: 1 hour | Basis: From the README

Run the Decionis MCP server so agents ask for authorization before risky tool execution.

**Who it is for:** Developer building an agent that calls MCP tools such as database, release, or package publishing tools.

**The problem:** An agent that can call a tool is not the same as being authorized to run that action in the current context.

**The outcome:** Each privileged tool call returns an explicit decision before it runs, and the agent can fetch the matching Decision Dossier.

### Steps

1. Run Decionis as a containerized MCP service in your Docker environment.
2. Register the Decionis MCP server with your MCP client so the agent can call it.
3. Instruct the agent to request authorization before any database mutation, package publish, or release creation.
4. Stop the tool call if the response is HOLD or BLOCK, and wait for PROCEED before continuing.
5. Retrieve the Decision Dossier for each governed call and store it with your run logs.

### Prompt to paste into your agent

```text
Using the decionis/docker repository, request an authorization decision from the Decionis MCP server for a database.drop action on <target database>. Expected output: a PROCEED, HOLD, or BLOCK verdict plus an evaluation ID. Verify that the agent does not call the drop tool unless the verdict is PROCEED.
```

### Caveat

The README describes the MCP server as a planned component released incrementally, so confirm it is available in your version before you build on it.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/decionis-docker/gate-privileged-mcp-tool-calls/

## How to watch agent authority decisions in Docker Desktop with Docker

Repo: [decionis/docker](https://github.com/decionis/docker) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Use the Docker Desktop extension to see PROCEED, HOLD, and BLOCK outcomes and pending approvals.

**Who it is for:** Security or engineering lead who wants live visibility into what AI agents are attempting in local or team Docker environments.

**The problem:** Without a view of decisions, teams cannot see which agent actions were held, blocked, or overridden.

**The outcome:** A live view of authority decisions, reason codes, pending Presence approvals, and policy drift or overrides.

### Steps

1. Install the Decionis Desktop Extension in Docker Desktop once it is available for your version.
2. Connect the extension to your running Decionis components.
3. Open the live decisions view and filter for HOLD outcomes.
4. Review the policy and reason codes for any held or blocked action.
5. Check the policy drift and override section for changes that need follow-up.

### Prompt to paste into your agent

```text
Using the decionis/docker repository, open the Docker Desktop extension and list the most recent PROCEED, HOLD, and BLOCK decisions with their policy names. Expected output: a table of decisions with verdict, policy, and reason codes. Verify that each HOLD has a matching pending Presence approval or a recorded resolution.
```

### Caveat

The README says the extension is designed to surface these views, so confirm which views ship in your release before relying on them.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/decionis-docker/watch-governed-agent-activity-in-docker-desktop/

## How to keep signed Decision Dossiers for audit trails with Docker

Repo: [decionis/docker](https://github.com/decionis/docker) | Difficulty: Intermediate | Time: 1 hour | Basis: From the README

Store Ed25519-signed dossiers that show why each governed action was authorized.

**Who it is for:** Compliance or security reviewer who needs evidence of why an agent action ran.

**The problem:** A log saying the agent was allowed to act does not show the policy, evidence, or approval behind the decision.

**The outcome:** Each governed action has a dossier with its policy version, reason codes, Presence verification, evidence hash, and signature that can be independently verified.

### Steps

1. Run governed actions through Decionis so each one produces an evaluation.
2. Retrieve the Decision Dossier for each evaluation, using the MCP server or the Desktop extension.
3. Save each dossier with its evaluation ID and timestamp in your audit store.
4. Verify each dossier signature independently using the Ed25519 public key and the method your release provides.
5. Review the policy version and Presence verification fields during audit.

### Prompt to paste into your agent

```text
Using the decionis/docker repository, retrieve the Decision Dossier for evaluation <evaluation ID> and list its verdict, policy version, reason codes, Presence verification, evidence hash, algorithm, and timestamp. Expected output: a structured summary of the dossier. Verify that the algorithm field reads Ed25519 and that the signature checks out.
```

### Caveat

The README says dossiers can be independently verified but does not name a verification tool, so the verification method here depends on what your release provides.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/decionis-docker/produce-signed-decision-records-for-audits/

## How to ship execution governance inside Dev Containers with Docker

Repo: [decionis/docker](https://github.com/decionis/docker) | Difficulty: Advanced | Time: 2 hours | Basis: From the README

Include Decionis in a Dev Container so every developer's agent inherits the same authority boundary.

**Who it is for:** Engineering manager standardizing AI-assisted development across a team's Dev Container setup.

**The problem:** Governance depends on every developer and agent implementing it separately, so it is often missing or inconsistent.

**The outcome:** The team's Dev Container carries the same Decionis policy and approval path, so governance travels with the environment.

### Steps

1. Add the Decionis components to your team's Dev Container configuration.
2. Attach the team's versioned policy so it applies in every developer environment.
3. Confirm that agents launched from the Dev Container send consequential actions to Decionis first.
4. Test one HOLD path and one BLOCK path in a non-production environment.
5. Share the Dev Container definition so new developers get the same boundary.

### Prompt to paste into your agent

```text
Using the decionis/docker repository, start the team Dev Container and send a test action named npm publish to Decionis from inside it. Expected output: a verdict with the policy name that governs the container. Verify that the verdict is HOLD or BLOCK under the team policy and that no publish runs.
```

### Caveat

The README lists Dev Container integration as a later focus area, so the exact setup steps are not yet documented in this repository.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/decionis-docker/add-execution-governance-to-dev-containers/