---
title: "Govern Kiro CLI"
---

# Govern Kiro CLI

What Neural Inverse Govern can do for Kiro CLI today: an advisory PreToolUse hook compiled from agent policy, with no managed location.

## Control level

| What | Level |
|---|---|
| Tool calls | **Monitored, advisory hook**: the developer can delete the hook file |
| Model traffic | Not routable through the gateway |

Kiro has no managed hook location, so Govern cannot lock its hook in place. The level was verified by running Kiro's documented PreToolUse input through the real enforcement hook and daemon; Kiro CLI itself was not run.

## What Govern compiles

Govern compiles the agent policy for the `kiro` engine into a PreToolUse hook file, `hooks/keystone-agent-policy.json`, for the user's `~/.kiro/hooks` directory. The hook runs Govern's enforcement hook with a 20-second deadline.

The endpoint agent's system service does **not** install this file, because the location belongs to the user. You can read the compiled file and its gaps on **Agent policy > Policy preview** with the engine `kiro`, and distribute it yourself.

## How failures and asks behave

- Exit status 2 blocks a call; any other status lets it run. The compiled command ends in `|| exit 2` so that failures block.
- Hooks answer only allow or block, so an `ask` rule becomes a block.
- Kiro documents the hook timeout field inconsistently (seconds or milliseconds).

## What remains uncovered

Every action, once the developer deletes the hook file. Treat Kiro as monitored: decisions the hook makes are reported to **Agent decisions**, but nothing stops a developer from removing it.

For enforcement, choose a tool with a managed hook location (see [Third-party AI coding tools](https://neuralinverse.com/docs/govern/third-party-tools/)).