Control level
| What | Level |
|---|---|
| Tool calls | Monitored, advisory hook: the developer can delete the hook file |
| Model traffic | Not routable through the gateway |
Kiro has no managed hook location, so Govern cannot lock its hook in place. The level was verified by running Kiro's documented PreToolUse input through the real enforcement hook and daemon; Kiro CLI itself was not run.
What Govern compiles
Govern compiles the agent policy for the kiro engine into a PreToolUse hook file, hooks/keystone-agent-policy.json, for the user's ~/.kiro/hooks directory. The hook runs Govern's enforcement hook with a 20-second deadline.
The endpoint agent's system service does not install this file, because the location belongs to the user. You can read the compiled file and its gaps on Agent policy > Policy preview with the engine kiro, and distribute it yourself.
How failures and asks behave
- Exit status 2 blocks a call; any other status lets it run. The compiled command ends in
|| exit 2so that failures block. - Hooks answer only allow or block, so an
askrule becomes a block. - Kiro documents the hook timeout field inconsistently (seconds or milliseconds).
What remains uncovered
Every action, once the developer deletes the hook file. Treat Kiro as monitored: decisions the hook makes are reported to Agent decisions, but nothing stops a developer from removing it.
For enforcement, choose a tool with a managed hook location (see Third-party AI coding tools).