Introducing AI Coding Agent Governance: Using Hooks to Bring Visibility to the ADLC | Endor Labs

What it claims

Hooks in Claude Code and Cursor can serve as a deterministic, operator-owned policy and audit layer that sits outside the model. Endor Labs' endorctl ai-audit uses them as a single handler for every event. The summary names the response fields. What it does not give is the exact semantics of those contracts, how much each harness's integration surface differs, and how Endor's 29 default policies behave.

How it works

Claude Code response contract. The handler's exit code decides how its output is read:

flowchart TD
  H[Hook exits] --> E{Exit code}
  E -->|0| J[Parse stdout JSON]
  E -->|2| B[Blocking: stdout ignored,<br/>stderr fed to model]
  E -->|other non-zero| N[Non-blocking error]
  J --> P{permissionDecision}
  B --> C[Action cancelled]

• On exit 2, the effect depends on the event. The tool call does not run, the prompt is erased, or the session cannot stop.
• permissionDecision takes one of four values: "allow", "deny", "ask" or "defer".
• When several hooks chain, precedence is deny > defer > ask > allow. This matters if you layer your own hook alongside Endor's.
• updatedInput rewrites the tool call before it runs. The page's examples are masking a path, stripping a flag and normalising a command.
• additionalContext injects guidance text into the model's context.

Cursor response contract. Cursor reads stdout JSON only:

• The two permissioned events return a HookPermissionResponse (permission, userMessage).
• beforeSubmitPrompt returns only { "continue": boolean }.
• afterFileEdit and stop are notification-only, and their return value is ignored. You cannot block on them.

Integration surface. Endor wires 6 Claude Code events and 13 Cursor events. The difference exists because Cursor has separate hooks for shell, MCP and file I/O, while Claude Code uses one PreToolUse event with matchers.

Policy types. Server-side policies cover shell allow/deny lists, sensitive-file patterns, MCP server allowlists and environment-variable rules. Most of the 29 defaults block. A few return "ask", which defers the decision to the user. Administrators can edit the defaults and add policies with custom messages for the user and, where the harness supports it, the agent.

How to use it

The page recommends starting with a logging-only hook before adding any policy. Its argument is that adding policy afterwards is a config change, not a re-architecture.

For Endor, configure endorctl ai-audit claudecode (Claude Code) or endorctl ai-audit cursor (Cursor) as the command for every hook event, in .claude/settings.json or .cursor/hooks.json respectively.

Limits

• Config examples missing. The settings.json and hooks.json examples did not survive in the fetched text, so the exact event names Endor wires are not shown.
• Policies not listed. The 29 default policies are not enumerated.
• Vendor post, no evaluation. There is no measurement of latency, false positives or bypass rates.
• Evasion not discussed. The page does not address how regex-based shell rules handle obfuscated or indirect commands.
• Cursor blind spots. Cursor's file-edit and stop events cannot block, so policy there is limited to the permissioned events.