# How does Provely learn from a failure it has not seen?

> Provely groups failures that no check decided into rules. A learned change that needs no signature applies after a replay gate, within a daily cap.

Canonical: https://provely.sh/rules/learning  
Last updated: 2026-10-18  

**Rules are optional. With the two lines and no rules file, Provely builds the checks for each agent at run time (just in time), from the tools it finds. `provely rules learn` learns rules from failures that no check decided.**

The static compiler (`provely rules scan`, `review` and `sign`) is for when you want more. Audit the plan before it runs. Share it with your team in git, or in your Provely account with `provely rules sync`. Make exceptions for an agent or a tool: skip a check, mark a read-only tool, or set a timeout. Some exceptions need a signature.

Learning is optional too. Provely records each failure that no check decided, and `provely rules learn` groups them. A learned change that needs no signature applies by itself after a replay gate and within a daily cap.

Rules and markers reach a check run in: TypeScript frameworks (sdks/typescript/src/defenses/runtime.ts:656, commit 5a8f6a6c); Python frameworks (sdks/python/src/provely/frameworks.py:637, commit d4fe6faf); TypeScript plain SDKs (sdks/typescript-instrumentations/src/plain-sdk.ts:249, commit e9aa6a40); Python plain SDKs (sdks/python-instrumentations/src/provely_instrumentations/plain_sdk.py:297, commit e9aa6a40). These callers are not yet in the SDK commit 4112bb06, where the settings and markers come from. On the Python frameworks paths, the grid at commit d4fe6faf passes 5 of 6 rules cases on every path. Read [the rules cases](/frameworks#rules-cases). The rules cases are not yet measured at the current heads for: TypeScript frameworks, TypeScript plain SDKs, Python plain SDKs.

Source: https://provely.sh/rules (retrieved 2026-10-17)

## Which learned changes apply by themselves?

- A change that needs no signature applies by itself.
- A change that needs a signature waits for a person.
- A change to a check that can never change is never written.

## What stops a learned rule from blocking good work?

- **The replay gate.** Provely replays the recorded calls. A rule that changes the outcome of a call that ended well waits for a person instead.
- **The daily cap.** At most five learned rules apply for each agent each day by default. The rest wait.
- **The revert.** A person reverts a learned rule with one action. The learner does not apply it again unless its evidence doubles.

## What does the learner read?

Ids, codes, shapes and hashes only. It never reads a value, a prompt, or a tool result. No language model takes part.

## Where does learning run?

In `provely rules learn`, on your machine or in CI. It never runs inside the agent process.

## Can I turn it off?

Yes. Set `learn.auto_apply: false`, and every learned rule waits for a person.

The replay gate, the default cap of five, and the default `learn.auto_apply: true` are those of `provely rules learn` in the CLI at commit 3671ddc1.

Source: https://provely.sh/rules/learning (retrieved 2026-10-17)

## Read next

- [Read the rules reference](https://provely.sh/rules)
- [Review and sign rules](https://provely.sh/rules/review)