So I built a plugin that hooks into before_tool_call at the process level. Checks run on every tool call: identity mapping, deny-by-default scope, enforcement, rate limiting, injection detection, and audit logging. The agent doesn't get a choice — governance runs before the tool executes.

Zero dependencies beyond Node.js. Adds <1ms per call. Works out of the box with no config, or customize with a policy file.