gate

Timing: before. Adjudicate permission at a boundary — disable an action until a condition is met. The veto, not the command.

• computer: privilege rings, PreToolUse hook, capability check, default-deny + allowlist
• social: law, licensing-to-act, a locked door

This is vibe-linter's core control (gatekeeper-not-driver). Math home: the supervisor of ramadge-wonham-supervisory-control (can only disable controllable events).

Up: control-methods