The Week in Agent Governance
Hook: The tool-call interception war just got real
The past few weeks have seen an explosion of open-source projects aimed at one problem: stopping agents from doing things they shouldn’t, before they do them. If you’ve been following HN, GitHub, or the broader AI agent community, one signal stands out — everyone is building their own version of Heed. DashClaw, Kintsugi, BetterClaw, Laya Guard, Driftcop, Traceforce, Votal — the pattern is identical. A developer watched something go wrong (a database deleted, a supply-chain compromise, API keys leaked through agents), and built a pre-execution gate. This isn’t fringe curiosity anymore. It’s infrastructure.
1. EU AI Act enforcement enters its second wave — Aug 2026 compliance deadlines hit LLM pipelines
The EU’s landmark AI Act enforcement began rolling out restrictions in February, and compliance-tech analysts are now mapping what happens in August 2026 when deeper operational requirements take effect — particularly Art. 14 (human oversight) and Art. 71 (post-market monitoring). For anyone shipping agentic systems, the message is clear: you can’t just build a system prompt into “be careful.” Regulators will expect documented evidence that humans can intervene, audit trails exist, and post-deployment behavior is monitored.
Heed angle: Plugin-enforced denylists with decision logging directly address both articles. Every rejected action becomes a compliance artifact. Every approved action gets recorded with context. This isn’t optional anymore if you’re operating in or serving EU markets.
2. DashClaw: Intercept agent actions before they execute
ucsandman’s DashClaw landed on HN this month as a full-stack answer to the “find out what my agent did after the fact” problem. It intercepts tool calls via PreToolUse hooks in Claude Code before execution, enforces YAML guard policies (allow/block/require_approval), records decisions to Postgres, and provides an SSE-based human approval channel with replay support. The author was honest about limitations upfront — contextual policies over full conversation history aren’t there yet. That gap is real, and it’s exactly where plugin-level behavioral monitoring (what we’re building into Heed) needs to grow.
Heed angle: DashClaw validates the hook-interception approach we’ve dogfooded. Where our path diverges: DashClaw relies on YAML rules for thresholds, while Heed enforces policies at the harness level through signed plugin bundles that can carry semantic understanding of intent, not just syntax patterns.
3. Kintsugi: Deterministic rule-based blocking beats LLM judgment
arr0wassass1n’s Kintsugi takes a stance that should make every agentic-ops engineer nod: “The decision to block a catastrophic command is made by deterministic rules a human wrote — never an LLM. A local model can only explain a command and add caution; it can never unlock or downgrade a rule-based block.” After auditing 1.4M fuzz inputs and a MITRE ATT&CK + GTFOBins corpus, Kintsugi achieved zero catastrophic commands classified as safe. It works at the process/PATH layer, not as a per-tool plugin, with native hooks for Claude Code, Cursor, Codex, Qwen, Gemini, Copilot, and OpenCode.
Heed angle: This confirms what the critical_denylist plugin already does. Our denylist runs as a compiled set of deterministic rules — no LLM in the loop for rejection decisions. The difference: Heed’s plugin system lets teams compose rulesets (denylist + allowlist + risk scoring) and load/unload them without touching code, whereas Kintsugi requires editing config files.
4. BetterClaw: The PocketOS incident response
jfan22’s BetterClaw was built in direct response to the PocketOS incident (April 25) — a Cursor agent running Claude deleted a company’s entire production database in 9 seconds, then zapped the backups. The agent had access to a Railway MCP server with destructive tools, and “be careful” in the system prompt didn’t bind anything. BetterClaw compiles natural-language workflow descriptions into directed graphs where each node declares allowed tools. A plugin hook blocks anything outside the graph before dispatching to the MCP server. Works with Claude Code, Cowork, and OpenClaw.
Heed angle: The “paragraph → graph” authoring model is intuitive but limits composability. Heed’s plugin system takes a different approach: plugins describe capabilities declaratively (critical_denylist, before_tool_call), and the harness composes them at runtime. No manual graph-authoring. But BetterClaw’s core insight — that system-prompt warnings don’t scale as control mechanisms — is precisely why Heed enforces governance at the harness layer, not in prompts.
5. Driftcop: Security scanning for MCP “rug pull” attacks
sudoviz/Driftcop addresses a novel threat vector: tools that were useful and benign yesterday auto-updating into something malicious today. Since MCP servers can suffer from command injection, permission reuse, and version drift, Driftcop saves approved tool metadata on first connection, then detects any drift (description changes, parameter shifts, version updates) and blocks the agent until a human reviews and re-approves. Signed with Sigstore for transparency logs.
Heed angle: Supply-chain integrity for agent tools is an emerging category. Heed’s plugin system already covers static policy enforcement; integrating continuous tool-integrity monitoring would be a natural extension. If a connected MCP server changes its tool definitions mid-session, Heed should refuse to proceed until the change is reviewed — same principle as Driftcop, enforced at a higher layer.
Closing Thought
The space is moving fast. What started as individual hobby projects has crystallized into recognizable patterns: pre-execution interception, deterministic rules over LLM judgment, auditable decision logs, and human-in-the-loop approval channels. These are exactly the primitives Heed was built around. The question now isn’t whether you need governance — it’s which layer you enforce it on. System prompts get ignored. Per-tool plugins are too fragmented. Harness-level enforcement with signed plugins is where the maturing solutions live.
If you’re building agents with tool access and you’re still relying on prompts alone for safety, this week’s headlines are your wake-up call.
See more at heed.run — plugin-enforced governance for agentic AI. Open source. Zero-trust by default.