Coverage — which agents, how far
How damn.dev governs most models — one environment layer that doesn't care which model drives the agent, plus cooperative hooks for tool-call visibility and gating.
"Governs most models" isn't one integration per framework. It's one environment layer that doesn't care which model drives the agent. Every harmful thing an agent can do has to cross one of three capabilities — network egress, credentials, or the filesystem — and governing those is model-invariant: it works the same whether GPT, Claude, or a local model is behind the wheel. That's the layer a cloud vendor structurally can't own, because owning it means running on your infrastructure, not theirs.
On top of that, cooperative hooks give you tool-call visibility and gating for the popular agent frameworks.
What's governed, and how far#
- Native damn.dev agents — governed all the way down, for any model: their tool calls are gated, their activity recorded, and the environment they run in is yours to lock down.
- Connected agents (Claude Code, Cursor, Codex, Copilot, an MCP-speaking agent, or a bespoke script) — gated or observed at the tool level out of the box, and fully governed at the environment when run inside a box you provision.
- Discovered tools — surfaced by the endpoint sensor: you know they exist and who runs them, nothing more.
Why the environment is the universal answer#
You don't enforce per-model — you enforce at the environment, which is the same regardless of the model. Host-granular egress, scoped credentials, and a sealed filesystem contain any agent running in a box you govern, no per-framework adapter required. And because it all runs on your own infrastructure, content never leaves your perimeter.
Ceiling — The tool-call gate is best-effort on a cooperating agent, recorded on a tamper-evident audit log — real and useful, not a claim of unbreakable containment. Full containment is the enterprise tier, and you can verify your guardrails fire — even offline — from Oversight → Security → Guardrails → Run guardrail check.
Next#
- Governing AI you don't run — the connectors in detail.
- Enterprise & advanced controls — the governed box and sovereign egress.
- Enforced vs Trusted — the line between what's enforced and what's trusted.