one policy across claude code, codex, cursor and copilot

Why One Policy Matters

Developers rarely use just one agent. In The Pragmatic Engineer’s 2026 survey, 70% of respondents used two to four AI tools at the same time and 15% used five or more. The promise to developers is “use whatever agent you like”, and it only holds if the security team does not rewrite every rule per tool. Each vendor’s admin controls are real but separate: Claude Code managed settings, Codex requirements.toml, Cursor enterprise hooks, Copilot policy hooks and managed settings. A normalization layer turns them into one contract.

Blocking Capability by Harness

Capabilities are version-sensitive. Re-test after upgrading an agent CLI, especially for anything beyond the pre-tool gate.

The Codex Hook-Trust Detail

Codex 0.129 and later only runs hooks from ~/.codex/hooks.json after they are approved interactively. Hooks in the system config (/etc/codex/config.toml) run without approval, so when failproofai config can use sudo it writes a managed block there. Without sudo, and on Windows, the hooks stay in ~/.codex/hooks.json, and failproofai config --status reports Codex as not enforcing until they are approved.

One Policy, Every Harness

ctx.cli names the source harness (for example claude, codex or cursor), so a reason or a rule can differ per agent when it needs to. The built-in block-force-push in the coding agent pack does the same job and is off by default.

import { customPolicies, allow, deny } from "failproofai";

customPolicies.add({
  name: "no-force-push-anywhere",
  description: "Same rule in every agent",
  match: { events: ["PreToolUse"] },
  fn: async (ctx) => {
    if (ctx.toolName !== "Bash") return allow();     // harness-native shell tools are normalized to Bash
    const cmd = String(ctx.toolInput?.command ?? "");
    if (!/\bgit\b.*\bpush\b.*(--force\b|\s-f\b)/.test(cmd)) return allow();
    return deny(`Force-push is blocked in ${ctx.cli ?? "this agent"}. Push a new commit instead.`);
  },
});

Watch for Hooks That Run Twice

• Cursor can load hooks from third-party tools such as Claude Code, so a Claude Code hook may also fire in Cursor.
• Copilot accepts Claude-format hooks and treats Bash(...) as an alias for Shell(...) in its managed rules.
• Duplicate evaluation is harmless for a deny, but it can double-count decisions in your own logs. Check Observe → policy after enabling a new harness.

Known Gaps to Plan For

• Gemini CLI is not one of the twelve supported harnesses. Govern it with its own system settings and policy engine.
• IDE-embedded agents that expose no hook surface cannot be gated by any hook-based tool. Failproof can trace Copilot in VS Code through OpenTelemetry (failproofai otel enable copilot), but that is visibility, not enforcement.
• Cloud-hosted agents (remote sandboxes, cloud agent runs) do not run on the laptop; govern them with the vendor’s cloud controls.
• Agents you build yourself report through the Python or TypeScript SDK for tracing; enforcement needs a hook at your runtime’s tool boundary.