The policy space for a coding agent is three verdicts wide: auto-approve, deny, or ask. The newest guards disagree less on the verdicts than on where the gate lives and what happens when the decision model is unreachable — the line between a cosmetic gate and an enforcement point.
The hook is the enforcement point
Automater's runbook on Claude Code and Jev states the distinction bluntly: an MCP server tool the model can decline to call is a second opinion, whatever its name says. Its prescription is one PreToolUse hook contract that denies on a risky verdict and on every Jev failure, with deny rules behind it, keeping MCP for lookups. It also places the launch-week cast — jkudish/jev-mcp at 227 stars, itsmostafa/typesafe-mcp at about 200, and LangChain's AutoModeMiddleware blocking tool calls at or above 0.5 (counts as of September 21, 2026) — and the coding-agent article covers that MCP side. The capture is truncated, so read the contract as its promise.
Allow, ask, or deny
jev-guard is the reference contract: it checks every shell command, file write, and file read before it runs and returns ALLOW, ASK, or DENY. Most calls are decided locally in under a millisecond — the project's own framing of its fast path, with no independent benchmarks — while ambiguous or destructive calls go to System One. It works with Claude Code, Codex CLI, and Antigravity, including autonomous modes like --dangerously-skip-permissions and --yolo. On API failure it asks instead of allowing — a fail-closed posture — and catastrophic actions never run automatically; the failure-modes article covers that choice.
The OpenCode guard is the same shape in another harness: an OpenCode 2 plugin that sends every shell command, local or over FarHand's remote shell, to Jev first with six typed questions — verdict, host_litter, global_install, global_config, harmful, privacy. A command counts as safe only if the verdict is run at or above minConfidence and every risk sits below its threshold; anything else asks. If Jev is unreachable, times out, or no key is set, it still asks — and the guard only ever adds prompts, never turns one your settings requested into an allow — the property to check in any guardrail.
Narrow gates, one contract
| Gate | Surface | Decision | Limit |
|---|---|---|---|
| Claude Jev Warden | Write, Edit, MultiEdit in Claude Code | 80% quality bar; exit 2 below it | built for SVG illustration work |
| Pi Jev Guard | Proposed edits in Pi | Markdown rules per violation | a review aid, not a linter replacement |
| jev-auto-approve | Pull requests via GitHub Actions | Approve only if every question clears your threshold | can approve or skip, never block |
Warden, built on Jev 1.13, runs at the OS process boundary via Claude Code's PreToolUse hook: approved edits exit 0, substandard work exits 2 with feedback injected into the agent's context, under an 80% bar the project's own audit runs set. A stand-alone CLI (node bin/jev-audit.js path/to/illustration.svg) prints model, score, verdict, and confidence. Pi Jev Guard installs with pi install git:github.com/Reindeer-AI/pi-jev-guard, reads TYPESAFE_API_KEY from Pi's environment, and reviews only edits under one instructionRoot chosen at policy load (edits outside are skipped), returning exact instruction text and source line ranges per violation. /jev status and /jev reload manage the policy. jev-auto-approve approves a pull request only when all three default questions — ready to merge, covered by tests, needs a human — clear the configured confidence threshold; a miss becomes a skip with a comment naming it. The confidence-gates article covers that choice.
Pre-flight on the prompt
Two hooks judge prompts before the main model reads them. Jev Pre-flight Gate is a UserPromptSubmit hook for WorkBuddy (and a pre_llm_call shell hook for Hermes Agent) that has Jev judge each prompt in about a second and injects a verdict line with dimensions like task_type, risk, and scope plus routing hints. It is fail-open by design — no key, timeout, error, or empty answer passes the prompt through — and three consecutive failures trip a 10-minute circuit breaker. The README's own measurement: 300 to 400 tokens per turn, a net loss near 1% on simple requests and positive in expectation overall.
The Codex hook, codex-jev-preflight, asks Jev for task_type, complexity, risk, and execution_mode, validates them against their enums, and injects them as advisory context that cannot override system instructions or an explicit user request. It carries a persistent breaker for exhausted quotas. The caveat here is privacy: every prompt sends the first 24,000 characters to a third-party endpoint, so sensitive text needs filtering.
What the gateways gate
The gateways put the same decision in front of generation. jev-decision-gateway batches small bounded questions through Jev and lets a deterministic policy layer — not the model — own thresholds and the execution plan; its README's before/after cuts an agent loop from four LLM calls per iteration to one gateway.evaluate() plus one generation call at the tier Jev picked. Jev answers typed Choice, Score, and Noul questions, and the repo states plainly it cannot write prose, summarize, produce code, or reason open-endedly.
Two more gateways matter. JEV Gateway is session-aware and OpenAI-compatible — it serves POST /v1/chat/completions, ships task_aware, quality, and economy strategies, and records requests, decisions, and outcomes in SQLite. JEV Safety Gateway sits between nginx and an OpenAI-compatible backend, asks whether user input is harmful, blocks risky requests with a 403, and passes the rest through unchanged. It decodes base64 segments before judging so encoded payloads cannot dilute the signal, and can be configured fail-open or fail-closed when Jev is unavailable. The safety gateway's README publishes no benchmarks, and the project is AGPL-3.0-or-later.
What to copy
- Put the gate where the model cannot decline it; keep MCP for lookups.
- Pick the failure posture per surface and write it down.
- Keep every gate additive: it may add a prompt, never remove one.
- Treat guards as review aids — tests, linters, and deny rules stay behind them.
