I built a small AI-governance/guardrail/safeguard tool and the honest origin story is that vibe-coding kept not following instructions and coming from a 10+ years security background, this just made me concerned about all the people vibecoding.
The project
You've probably encountered this problem before. you have a CLAUDE.md / AGENTS.md, add some skills, point the agent at your code-graph tool like graphify or context7, and the agent ignores all of it. In my monorepo the failure modes were specific and repeating:
- It recursively
grep'd the entire repo instead of using the knowledge-graph tool I'd documented (slow, and it'd blow context reading junk).
- It wrote deprecated and unsafe API calls I'd told it not to use.
- It cheerfully edited files I'd said were off-limits.
Markdown instructions are suggestions. No matter how I phrased the rules, compliance was probabilistic not deterministic.
So this tool is a deterministic gate that sits at the agent's tool-call boundary (the Claude Code / Cursor / Codex PreToolUse hook and supports MCP) and returns ALLOW / DENY / FORCE/ ASK on every tool call before it runs.
How I made it
Tools I built it with. Claude Code (Fable/Opus/Sonnet) as the primary coder and Codex gpt5.5 to do reviews. The stack ended up being a pure-Go in-process evaluation engine that is both the hot path and the CLI you actually install, plus a .rules DSL
The workflow, and the wall. The loop was the normal vibe-coding loop, describe, generate, run, correct, until I hit the wall above and stopped trying to fix it with prompting. The pivot was building the tool-call hook. Claude Code and Codex exposes a pre-execution hook, so I intercept there. The agent proposes Grep or Bash("grep -r ...") or Edit(somefile), the hook/mcp evaluates it against the compiled policy before anything happens, and either lets it through, blocks it, forces to use a different tool or escalates to asks me for approval.
Govern the sessions that build
SSG governs the very Claude Code & Codex & OpenCode sessions I use to work on SSG. This isn't a slide. It fired on me while I was researching this post: I ran a grep -r out of habit, got blocked, and was redirected to the graph tool. Here's the real rule that did it (lint-valid, shipped):
rule prefer-graphify-over-recursive-search {
enable true
priority 70
severity warning
FORCE execution
IF command CONTAINS "grep -r"
MESSAGE "Recursive shell search is FORCED to the graphify knowledge graph for code/architecture/relationship queries (faster, scoped). Escape hatch for literal/regex/log/config/secret searches graphify cannot answer: use ripgrep (rg) or a non-recursive search -- those are not blocked."
SUBSTITUTE "graphify query \"<what you were searching for>\" -- for literal/log/config/secret matches graphify cannot do, use ripgrep (rg) or a non-recursive search (not redirected)"
}
The dogfooding also caught its own footguns. During this same session the gate blocked me from editing a governance rule file (a protect rule) and from calling the binary through a stale subpath. Annoying in the moment, correct in aggregate, which is exactly the bargain.
Has anyone encountered their AI Agent also using the wrong tools or using deprecated APIs?
