⌘ the internet is hard.
← THE OPEN WORKBENCH

AGENT GUARDRAILS / GITHUB

Keep the next tool call inside the agreement.

A scope check at the point where an assistant is about to act.

THE PROJECT, IN PRACTICE

What you can do with it.

01

Check before execution

A PreToolUse hook evaluates the proposed tool call before it proceeds.

02

Use the agreed scope

Jev assesses the call in relation to the user’s request and agreement.

03

Give a reason

Out-of-scope calls are denied with an explanation that the assistant can act on.

FROM IDEA TO USE

How it works.

  1. 01

    Review the integration

    Choose the host integration and inspect its configuration and examples.

  2. 02

    Define the work

    Give your assistant a clear task and constraints.

  3. 03

    Check proposed actions

    The hook submits the proposed call for a scope decision and denies it when outside the agreement.

A scope check in context
Agreed task: inspect a failing test.
Proposed action: change an unrelated deployment.

The hook checks whether that action belongs
to the work the user requested or approved.

Illustrative scenario—not a recorded decision or a live model response.

TAKE IT FOR A SPIN

Start here.

Review the repository’s host integrations, examples, and configuration before enabling the hook in your assistant. The integration files are the current setup reference.

STATUS & REQUIREMENTS

Uses TypeSafe’s Jev for scope judgments. This is a model-based control; review host behavior and the repository tests when adopting it.