Skip to main content
Coding Agent Governance gives security and engineering teams visibility and control over AI coding agents across developer workstations and cloud environments. It inventories the agents, models, MCP servers, and skills in use. It monitors agent actions such as commands, file access, and tool calls, and enforces policies to block, alert on, or require approval for risky behavior before it executes. Secure coding checks extend these controls with detection backed by Endor Labs intelligence. The malware check looks up packages in the Endor Labs malware feed, and the secrets check scans content the agent writes or reads. See Secure coding checks for more information. These controls are guardrails for accidental agent behavior, not a sandbox or hard security boundary. See How Coding Agent Governance works for what that means in practice and how events flow into Endor Labs.
Keep three operating caveats in mind when you rely on Coding Agent Governance:
  • Enforcement fails open. If a hook cannot run, or a malware policy cannot reach Endor Labs for a verdict, the action proceeds, and the event is missing from inventory and policy violations until the cause is fixed. An unreadable policy cache still enforces the built-in system policies. See Limitations.
  • Policy changes apply at the next session start. Hooks evaluate against the policy snapshot fetched when a session starts, so tell developers to restart the agent after a policy edit. See Local policy cache.
  • Redaction is pattern-based. The redactor masks secret-named keys and known credential formats before an event leaves the machine, but a secret in an unknown format can still reach the backend. See Data sent to Endor Labs.

​
Supported agents and platforms

Coding Agent Governance enforces policies for supported agents on developer machines. Endor Labs discovers other AI coding tools at session start but does not govern them.
¹ Claude Cowork: Not supported while claude-code issue #40495 is open. The Cowork sandbox ignores user settings, managed settings, and environment variables, so governance hooks never load and Cowork sessions are neither monitored nor governed. The failure is silent. Use Claude Code (app or CLI) for governed work.² Claude Cloud: Hooks run inside the hosted sandbox and fire from session start.³ Cursor Cloud: Agent lifecycle events, such as stop and agent response, do not fire.⁴ Cursor CLI: Shell command hooks fire reliably. Prompt, file edit, and stop events do not. On Windows, run the CLI under WSL.

​
Set up

1

Complete the prerequisites

Confirm tenant access, check license eligibility, and create an API key with the AI Audit User role. See Prerequisites.
2

Deploy hooks

Install hooks for Cursor, Claude Code, Codex, and GitHub Copilot. To roll them out across a fleet, see MDM deployment and build each configuration with the in-browser generator.

​
Operate

1

Review your inventory

Find the agents, MCP servers, models, and skills your developers use, each rated with an Endor Score. See Review your agent inventory.
2

Triage policy violations

Filter, read, and respond to violations from your governed agents as they arrive. See Triage policy violations.
3

Review and extend policies

Endor Labs ships an in-built policy catalog enabled by default. Review it, then add custom rules for what to block, alert on, or ask permission for. See Write a policy.

​
Plan your rollout

Pick your AI coding agent and rollout style. The wizard returns a tailored checklist with deep links to every page you need.

​
Names you’ll see

Each name is tied to a specific surface of the same capability:
  • Coding Agent Governance is the feature name, used across this documentation.
  • Agent Governance is the name in the Endor Labs user interface, on the left-sidebar entry and on the policy tab under Policies & Rules.
  • AI Audit is the machinery hooks run as. It appears in the AI Audit User role for hook API keys, the endorctl ai-audit command, and the ENDOR_AI_AUDIT_* environment variables.

​
Frequently asked questions

No. It puts guardrails around agent behavior, not a sandbox, firewall, or hardened boundary. Policy controls lower the risk and blast radius of agent mistakes, but hard guarantees require isolation at the operating system, system call, or sandbox level, which Coding Agent Governance works alongside. See What Coding Agent Governance is (and isn’t).
No, and that is by design. It targets accidental agent behavior, not a person deliberately trying to defeat the controls. See What Coding Agent Governance is (and isn’t).
The agent receives a deny response explaining that a governance policy blocked the action and telling it not to work around the block. The event appears in Policy Violations. See Hooks and what they govern.
Policies match commands and patterns, not the end effect, so an agent can occasionally reach the same result another way. That trade-off comes with best-effort, pattern-based controls. See Limitations.
Block, Alert (record only), or Ask Permission, written as blocklists or allowlists over shell commands, file access, and MCP tool calls, plus secure coding checks for malware and secrets. See Write a policy.
Yes. The malware check stops installs of packages flagged by the Endor Labs malware feed, and the secrets check scans content the agent writes or reads on the developer’s machine. A secrets violation reports the rule and location, never the secret value. See Secure coding checks.
Yes. Override a system policy with one of the same name and a different action, turn it off in the policy list, or author your own from the same templates. See Write a policy.
Every command line, file path, URL, environment value, and MCP tool input or output passes through a redactor on the developer’s machine before the hook sends anything. Secret-named keys and common credential formats become [REDACTED]. Prompt text stays local. See Data sent to Endor Labs.
Endor Labs discovers skills at session start and rates them with an Endor Score, and policies can flag or block suspicious ones. It assesses plugins through the MCP servers and skills they contribute, not as a single unit. See Skills.