Enforce deny-by-default policy rules on agent tool calls with audit logging.
npx skills add https://github.com/thistleknot/skills --skill agent-governance-thistleknot
Please help me install this Agent Skill. Skill: agent-governance Source: https://github.com/thistleknot/skills/tree/main/agent-governance Command: npx skills add https://github.com/thistleknot/skills --skill agent-governance-thistleknot
Agent-governance prevents unsafe or unauthorized actions by adding policy-based tool access controls, audit logging, and intent-aware enforcement—especially for destructive, high-blast-radius operations.
Apply the agent-governance skill to your agent tool layer so every tool call is intercepted, denied-by-default unless explicitly allowed by policy, and recorded in an audit trail.
High-intent search queries and answers about installing and using this skill.
Agent governance prevents unsafe autonomous actions by intercepting tool calls and enforcing deny-by-default policy controls. It classifies semantic intent for operations like delete, execute, or network calls, blocking disallowed high-blast-radius activities before they occur.
Semantic intent classification maps tool calls and arguments into intent tiers like read, write, delete, exec, or network. This mechanism allows agent governance systems to express and enforce safety rules at the action level rather than relying on simple pattern matching.
You establish deny-by-default tool access control by applying source-controlled ALLOW/DENY rules to the agent tool layer. This tool guardian pattern intercepts every call, evaluates it against policy, and blocks any action not explicitly allowed.
Yes, agent governance converts policy checks into GitHub status checks that block merges on failure. By integrating secrets scanning and policy enforcement into your pipeline, you prevent unsafe disclosures and unauthorized actions from being committed.
Audit logging creates append-only, tamper-evident records with hashed arguments to reduce secret leakage risk. This ensures every allowed or denied tool access attempt is securely recorded for monitoring without exposing the actual sensitive data passed.
Secrets scanning detects common key, token, and password patterns in agent output to block unsafe disclosures. This prevents sensitive information from being transmitted or committed by intercepting risky data during the governance enforcement phase.
wfvueConfigure Tauri v2 permission controls with allow/deny rules and capability mappings.
WellFitCommunityScan codebases for HIPAA compliance violations involving PHI.
huseyindenizAnalyze TypeScript/JavaScript source code for hardcoded secrets and unsafe patterns.
MomoDavilukeScan Claude Code configurations for vulnerabilities and misconfigurations using AgentShield.
