---
title: "Govern Windsurf"
---

# Govern Windsurf

Enforce Neural Inverse Govern agent policy in Windsurf (Devin Desktop) with the system-level Cascade hooks file, and what remains uncovered.

## Control level

| What | Level |
|---|---|
| Commands, code reads, code writes and MCP tool calls | **Enforced** with the system-level Cascade `hooks.json` |
| Cascade's web search and other tools without a pre-hook | **Not covered** |
| Model traffic | **Not controlled**: Windsurf has no custom model endpoint and no audit feed of model requests |

The level was verified against Windsurf's documented Cascade hooks by running their documented input through the real enforcement hook and daemon. Windsurf is closed source and was not run.

## 1. Write the policy and enrol the machine

Write rules in **Agent policy** ([Agent policy](https://neuralinverse.com/docs/govern/agent-policy/)) and enrol the machine with the endpoint agent ([Deploy](https://neuralinverse.com/docs/deploy/)). The agent fetches the policy compiled for the `windsurf` engine and installs `hooks.json` in the system location, which needs root to change:

| OS | Location |
|---|---|
| Linux | `/etc/windsurf` |
| macOS | `/Library/Application Support/Windsurf` |
| Windows | `C:\ProgramData\Windsurf` |

The file registers Govern's enforcement hook on `pre_run_command`, `pre_read_code`, `pre_write_code` and `pre_mcp_tool_use`. Windsurf merges it with user and workspace hooks.

## 2. How failures and asks behave

- Windsurf blocks only on exit status 2 and lets the action run on any other status, so the compiled command turns every failure into exit 2.
- Cascade hooks answer only allow or block, so an `ask` rule becomes a block.
- The hook timeout is not documented by Windsurf.

Check the gaps on **Agent policy > Policy preview** with the engine `windsurf`.

## Model traffic and audit

Windsurf cannot be routed through the gateway and has no audit feed of model requests. Plan for that gap: if model access must be governed, provide a tool that can be routed, and block the providers' APIs at your network edge.