Plugin-enforced governance · Agents can't skip it

Your agent just pushed to production.
Without asking.
Take Heed.

Heed installs inside your agent harness — intercepting every tool call before execution. The agent can't bypass it. Zero API calls on the hot path. Full audit trail.

Install the plugin → See how it works

Plugins for Hermes, OpenClaw, Claude Code, Cursor.
If it has a hook system, Heed enforces it.

Approval requests Live

The problem

AI agents break things
in new ways.

billing-agent: approved $47,200 refund
→ policy threshold: < $50,000 ✓

The policy loophole

Your agent followed the rules exactly. The rules were wrong for this case. Nobody reviewed it before the money left the account.

email-agent: sent campaign
→ recipients: all_customers (48,203) ✓

The blast radius

The agent was configured to send emails. Nobody specified that "send" meant "send to everyone, right now, with the draft copy."

code-agent: git push origin main
→ Friday 16:47 EST ✓

The Friday deploy

Your agent fixed the bug and pushed. Nobody told it that main is production, Friday is sacred, and this particular fix had a side effect.

These aren't hypotheticals. They're the support tickets developers are filing right now.
The problem isn't that your agents are bad. It's that consequential actions need a human in the loop — and cooperative gates don't work. We proved it: agents skip them.

How it works

Three steps. One API.

The harness intercepts every tool call

Before any tool executes, the Heed plugin fires. It classifies the action, checks policies, and gates it — all inside the execution pipeline. The agent can't bypass because it doesn't control this step.

POST /api/v1/hitl/requests
X-API-Key: hd_live_...

{
  "action": "send_refund",
  "summary": "Issue $4,200 refund
  to ACME Corp (outside policy)",
  "context": {
    "amount": 4200,
    "customer": "ACME Corp"
  },
  "callback_url": "https://app.co/decision"
}

High-risk actions get held for approval

When a policy match hits, the tool call is blocked and the right human gets notified — Slack, email, or native harness prompt. One click to approve or reject. Works on mobile.

Slack notification
⏳ Approval required
billing-agent wants to issue a $4,200 refund to ACME Corp.
This is outside the standard policy threshold.

              ✓ Approve
              ✗ Reject
            

Approved actions execute. Blocked ones don't.

If approved, the harness executes the tool call. If denied, the agent gets a block message. Everything is logged with full context. You have a complete audit trail.

// Webhook payload → your callback_url

{
  "id": "req_a3f5e2c1...",
  "status": "approved",
  "decided_by": "sarah@co.com",
  "decided_at": "2026-05-29T14:32:11Z",
  "action": "send_refund"
}

// Signed with HMAC-SHA256
// X-Heed-Signature: sha256=...

Not cooperative. Enforced.

Cooperative gates fail because agents skip them.
Heed enforces — the agent can't bypass.

MCP servers, decorators, and system prompts are suggestions. Heed is a gate the agent can't walk around.

Cooperative gates

Will my agent call the gate?

MCP servers, decorators, and system prompts ask the agent to check in before acting. Our dogfooding proved: 0% compliance. Agents optimize for task completion, not governance.

Heed

Can my agent bypass the gate?

No. The plugin lives inside the harness execution pipeline. The agent outputs a tool call — the harness fires our hook before executing. The agent can't skip step 2.

Features

Everything you need.
Nothing you don't.

Policy engine

Rule-based classifier matches tool calls in <1ms. Three tiers: pass-through (no match → execute instantly), grace period (low-risk → execute + notify), HITL gate (high-risk → block until human decides). Natural language policies coming soon.

One-click approval

Email and Slack cards with approve/reject buttons. No login required. Works on mobile. The decision takes 10 seconds, not 10 minutes.

Immutable audit log

Every request, decision, and webhook delivery is logged append-only. SOC 2 and EU AI Act Article 14 ready. Know exactly what happened and when.

Shadow mode

Install the plugin, set mode: shadow. Every tool call is classified and logged — nothing is blocked. Review the audit data, tune policies, then flip to enforce. Zero-risk onboarding.

Local-first privacy

Classification happens on your machine. 99%+ of tool calls never leave your infrastructure. Only denied and high-risk calls feed the shared classifier. Enterprise: full on-prem, zero data egress.

Multi-harness

Plugins for Hermes (Grade A), OpenClaw (Grade A), Claude Code (Grade B), and Cursor (Grade B). Same classifier, same policies, same audit trail across every harness your team uses.

Compliance

The EU AI Act requires human oversight. You need a paper trail.

"High-risk AI systems shall be designed and developed in such a way, including with appropriate human-machine interface tools, that they can be effectively overseen by natural persons during the period in which the AI system is in use."

— EU AI Act, Article 14 (Human Oversight)

If your agents touch healthcare, finance, legal, government, HR, or critical infrastructure, Article 14 applies. Heed gives you the human control layer and the audit trail to prove it.

Every agent action request logged with full context
Human decision recorded with timestamp and identity
Policy rules versioned and auditable
Immutable append-only event log — tamper-evident
Configurable approval expiry and escalation
On-premise deployment available for sovereign data requirements
Plugin-enforced governance — agents cannot bypass the gate

Pricing

Start free.
Scale when you need to.

No credit card required. Upgrade or downgrade anytime.

Free

For evaluation and personal projects

5,000 evaluations / month
10 policy rules
Shadow + enforce modes
7-day audit log retention
1 tenant

Get started →

Starter

$29/mo

For small teams shipping agents

100,000 evaluations / month
Custom policies
Email + Slack
Full audit trail
3 tenants