Interlock holds agent-authored PRs to stricter rules than human ones, which means the first thing it has to answer is who wrote this. That answer comes from an allowlist you configure, and it is deliberately conservative: a PR counts as agent-authored only if it matches a pattern you listed, and anything that does not match is treated as human.
Three signals are checked, and any one of them is enough. The author account can match a login glob such as *[bot]; the head branch can match a prefix such as claude/*; or a commit can carry a git trailer such as Co-Authored-By: Claude. In CI the GitHub Action classifies by the PR author's login, which is the reading that actually gates a merge; the local CLI classifies by commit author name as an advisory pre-flight, and the two can differ for the same commit.
The failure direction is the honest part. An agent that does not announce itself is classified human and gets the lenient tier, so interlock is a governance aid that makes agent PRs legible, not a containment wall. It governs cooperating agents; pair it with branch protection for the ones that lie.