Neural Inverse Govern / Agent policy and approvals
Allow, ask or deny for every agent action, with a named person for what matters.
One policy written in Govern, compiled for each agent engine, signed, and enforced on the developer's machine by the endpoint agent and on the server by Govern's gateways.
- Effects
- Allow, ask or deny
- Covers
- Shell, files, network, git, packages, MCP tools, models
- Delivery
- Ed25519-signed manifest
- Approvals
- One inbox, never your own request
- Templates
- Eight sector templates
Overview
Agent policy decides what coding agents may do on a developer's machine or in a sandbox: which commands they run, which files they read and write, where they connect, what they push and install, which hooks run, and which MCP tools and models they use. You write one policy. Govern compiles it for each engine and signs it; the endpoint agent enforces it locally, and the model and MCP gateways enforce the model and tool rules on the server.
What it does
What agent policy and approvals do.
Rules, defaults, approvals and delivery, with a record of every decision.
Ten action kindsShell commands, file reads, file writes, network destinations, pushes, force pushes, package installs, approved hooks, MCP tool calls and models, each with its own pattern.
Organisation, team and projectRules are set for the organisation, a team or a repository. Organisation and team rules can be locked so lower levels cannot override them.
Strictest rule winsEvery matching rule counts, and deny beats ask beats allow whatever the pattern's specificity: an allow on feature branches does not open main if pushes are denied.
Shell lines splitA command line is split into each command it runs, across pipes, chains, substitutions and nested shells. Privilege wrappers and environment prefixes are stripped before deny rules are checked, and a line that cannot be parsed is refused.
Safe defaults and delegationWithout a rule, shell commands, file writes, network access, pushes, installs and MCP tools ask, and force pushes are denied. The organisation decides per kind whether teams or projects may loosen a rule; otherwise they can only tighten.
Named approversAn ask can be confirmed by the developer in the tool, or sent to up to twenty named people or teams who decide in Govern. The requester can never approve their own request.
Once or for the sessionAn approval allows the action once, consumed just before it runs, or for the rest of the agent session until the grant expires. Pending requests expire, and each is re-checked against the person's current policy.
One approvals inboxAgent actions, MCP tool calls, AI Gateway tool calls and just-in-time access requests wait in one inbox, and can also be sent to webhook, email, Slack and PagerDuty with signed single-use links.
Sector templatesStarting rules with their rationale for firmware, FPGA, PLC and industrial control, automotive, avionics, medical devices, finance and mainframe. Applying one never removes or loosens a rule you already have.
Preview and gapsBefore you publish, see exactly what one person gets in one project on one engine, the files that will be installed, and every rule the engine cannot express exactly.
Approved hooks onlyOnly hooks your organisation approved run, through the endpoint agent, which checks the script's hash first. A hook is approved by someone other than the person who submitted it.
Signed deliveryThe endpoint agent verifies each Ed25519-signed manifest and refuses one older than the one it holds, so a replayed manifest cannot restore a looser policy.
Revoke and suspendRevoke one person, and their manifests deny every action on every engine and project; suspend the organisation, and every agent stops. Online agents receive it within five minutes.
Decision logEvery decision is reported with the person, project, engine, kind, outcome, the rule that made it and the approval behind it. Commands, paths and hosts are never stored, only a hash of the target.
How it works
From a written rule to a recorded decision.
- WriteRules and defaults for the organisation, teams and projects, or a sector template to start from.
- PreviewThe effective policy and compiled files for one person, project and engine, with every gap listed.
- SignGovern compiles the policy for each engine and signs the manifest.
- EnforceThe endpoint agent verifies the manifest and decides every action on the machine.
- ApproveAn ask with named approvers waits for one of them in the approvals inbox.
- RecordThe decision, its rule and its approval go to the decision log.
Who uses it
Built for every role that answers for AI.
Security and platform teamsWrite rules and defaults, apply sector templates, preview each engine and approve hooks.
Named approversTeam leads, release managers and safety owners decide agent actions in one inbox, once or for a session.
EngineersKeep working with their agent; confirm the actions the policy asks them about, and see why an action was refused.
AuditorsRead the decision log and the history of every policy change, with who made it and who approved.
Enforced and recorded
Where agent policy holds, and what it leaves behind.
Local actions are enforced by the endpoint agent where it runs. Model and MCP rules are also enforced on the server.
Enforced
On the machineEvery action goes through the endpoint agent, which answers before the engine's hook deadline and denies on any internal error.
OfflineThe last verified manifest is used until it expires. After that, every action is denied until a fresh manifest verifies.
On the serverModel rules are enforced again by the AI Gateway, and MCP tool rules by the MCP gateway, whatever the client does.
ApprovalsThe requester never approves their own request, a one-time grant cannot be used twice, and a revocation or changed rule applies before a stored request is answered.
Recorded
DecisionsEvery decision with its rule, outcome and approval; the target only as a SHA-256 hash.
Policy changesEvery change to settings, rules, templates, hooks, approvals and revocations is audited in its own transaction. If the event cannot be written, the change fails.
Separate dutiesWriting rules and approving actions or hooks are separate permissions, so the people who write policy need not be the people who approve.
Rules over shell commands reduce what an agent can reach; they are not an isolation boundary, and a program a rule allows can do anything it is able to do. How far policy reaches inside a third-party tool depends on the tool. Automatic escalation and auto-rejection of approvals are partial; test them before you rely on them.
Developer machinesThe endpoint agent fetches a fresh manifest every five minutes while online and installs each engine's compiled files.
Disconnected workThe offline grace period is yours to set, from none to thirty days. Keep it short where fast revocation matters.
Self-hostedSigning keys are configured by your operator, and the public keys are served by your own installation.
Hosted by usWe run it for you. Named approvers and custom hooks depend on the plan; a self-hosted installation includes everything.
Get started
Set it up with the documentation.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.