Control level
| What | Level |
|---|---|
| Commands, code reads, code writes and MCP tool calls | Enforced with the system-level Cascade hooks.json |
| Cascade's web search and other tools without a pre-hook | Not covered |
| Model traffic | Not controlled: Windsurf has no custom model endpoint and no audit feed of model requests |
The level was verified against Windsurf's documented Cascade hooks by running their documented input through the real enforcement hook and daemon. Windsurf is closed source and was not run.
1. Write the policy and enrol the machine
Write rules in Agent policy (Agent policy) and enrol the machine with the endpoint agent (Deploy). The agent fetches the policy compiled for the windsurf engine and installs hooks.json in the system location, which needs root to change:
| OS | Location |
|---|---|
| Linux | /etc/windsurf |
| macOS | /Library/Application Support/Windsurf |
| Windows | C:\ProgramData\Windsurf |
The file registers Govern's enforcement hook on pre_run_command, pre_read_code, pre_write_code and pre_mcp_tool_use. Windsurf merges it with user and workspace hooks.
2. How failures and asks behave
- Windsurf blocks only on exit status 2 and lets the action run on any other status, so the compiled command turns every failure into exit 2.
- Cascade hooks answer only allow or block, so an
askrule becomes a block. - The hook timeout is not documented by Windsurf.
Check the gaps on Agent policy > Policy preview with the engine windsurf.
Model traffic and audit
Windsurf cannot be routed through the gateway and has no audit feed of model requests. Plan for that gap: if model access must be governed, provide a tool that can be routed, and block the providers' APIs at your network edge.