Endpoint seats

Inline governance works by being on the wire. Token Observe issues the agent its credential, pins the endpoint, and refuses the call before it dispatches. A developer on a Claude Code, Codex or Copilot subscription defeats every part of that arrangement without trying: the credential came from the vendor, the endpoint is the vendor’s own, and the shell command or file edit the tool is about to run never traverses a gateway at all. An estate can be fully governed on its agents and completely unobserved on the people writing them.

What the vendors ship instead is an administrative extension point. Claude Code, Codex and Copilot all support a hook that runs before a tool call, whose non-zero exit blocks it, configured from a managed-settings location a device-management channel writes and the developer does not. That is a real enforcement point, and it is the only one available on this surface — so Token Observe treats it as the mechanism rather than pretending the gateway reaches further than it does.

The field that decides whether any of this is enforcement or advice is how the configuration arrived. Token Observe records managementChannel on every enrolled device as mdm, manual or unmanaged, requires it at enrolment, and never defaults it — a default there would be the product inventing the evidence for its own coverage claim. A hand-installed hook still works and still enforces every policy in the bundle it holds; it is also a file the person it governs can delete, so the seat census reports it as delivery rather than as enforcement.

And this control lives on a machine whose user is the subject of the policy. The code, the bundle and the clock are all on the developer’s laptop. The product’s threat model states that plainly and treats device management as a prerequisite rather than a mitigation: without it, this is advice with good telemetry.

Every vendor hook system fails open on timeout: the hook is slow, the client stops waiting, the tool call proceeds. A hook that round-trips to a central server therefore turns every Token Observe outage, every slow VPN and every DNS blip into a silent, org-wide policy bypass — and turns it on at precisely the moment nobody is watching. So the decision is made on the device, against a bundle it was given in advance, and the hook makes no network call at all. That is not a comment in the source; a test in the package asserts it statically and at runtime, because it is one well-meaning line away from being lost.

The consequence is that the hook has to be the strict one, since nothing downstream of it will be. Every failure it can reach — no bundle, an unreadable file, a bundle or trusted key any local account may rewrite, a wrong key, a forged payload, an expired or stale artifact, one issued to another seat or another install, an unknown vendor event, an unreadable payload, missing configuration, an internal throw, or its own deadline elapsing — refuses. There is no path through it to an allow without a verified bundle having said so.

There are two deadlines, and the reason there are two is that the vendor’s expiry is an ALLOW and the hook’s is a DENY. The soft budget of 50ms is checked at each checkpoint before more work is started: past it the runner stops, because it would rather deny at 51ms than risk being the reason the client gave up and proceeded. The hard wall of 150ms is checked once a decision exists, and a verdict that arrives later than that is discarded even when it is an allow — by then the client may already have stopped waiting and failed open, so a late allow is not an allow. An operator may widen the wall, but only to 1,000ms; a hook deadline set near the vendor’s own timeout is not a deadline, and refusing loudly is the only way an operator discovers they disabled the control by widening it.

An allow says nothing at all: exit 0, no output, and never an explicit permission decision of allow. On clients that honour one, an explicit allow suppresses the user’s own confirmation prompt, which would mean Token Observe loosening a control it never set and did not evaluate. No objection is the strongest thing a governance hook is entitled to say.

The hook contains no policy logic. It resolves configuration, reads two files, translates a vendor payload, and hands the result to the same evaluateGovernance the MCP gateway calls — same input, field for field — with PII from the same detectors, injection from the same scorer and permissions from the same deny-by-default RBAC evaluator. That is what a pure, dependency-free domain package buys: the same bytes of policy logic run on a laptop and in the gateway, so the verdict a seat gets and the verdict an agent gets for the same policy are the same verdict because they are produced by the same call.

The tool namespace is mapped rather than invented. An MCP tool reached through a vendor client arrives as mcp__github__create_pr and is mapped onto the same tool:github/create_pr resource and the same bare tool name the gateway uses, so one rule governs the agent going through the gateway and the developer’s editor going direct. Both halves are mapped, not just the resource: policy triggers match their tool pattern against the NAME, so mapping the resource alone would leave every rule firing for agents and silently not for seats — the exact failure this product exists to prevent. A built-in tool has no server namespace and is scoped by the vendor tool it belongs to, as tool:claude_code/Bash, which stops a built-in colliding with an MCP server that happens to share its name. A prompt submission is decided as a reserved tool name too, so it is a real RBAC resource that a role has to grant rather than an exemption taken in an adapter.

Direction is a required field rather than something an adapter guesses, because getting it backwards silently disables a policy. Pre-tool arguments are outbound and scored as user-authored input; a post-tool result is inbound and scored as a tool result, which the injection scorer weights higher because the author of a tool result is data rather than a principal. Post-tool evaluation drops the numeric ceilings and any pre-tool approval: they were consumed before execution, and re-running them would turn a completed action into a misleading post-hoc budget refusal or ask a client to repeat a side effect.

Where the three vendors differ is in how a refusal can be spoken after the action has already run, and Token Observe uses each one’s documented channel rather than a single lowest common denominator. It also refuses to pretend the weakest of them is the strongest: Claude Code’s replacement output must match each built-in tool’s schema, so a governed result there can only stop the loop, the original stays in the transcript and may reappear on resume, and the evidence record marks that as a terminal stop rather than as withheld.

Every bound this control leans on is measured on the device’s own clock. Expiry, freshness and approval time-to-live are all now minus a timestamp, where now is whatever the caller reads from the machine the governed party administers. On an unmanaged device that party controls the clock: set it back and an expired bundle is resurrected, a stale one looks fresh, and a lapsed approval is live again — which makes the freshness bound, the stated limit on how long a retired seat keeps working, not a bound against exactly the person it exists to bound. Nothing in the current design detects it, and the skew tolerance deliberately does not try. Closing it needs an anchor the device cannot rewind: a monotonic counter, a high-water mark of the newest bundle seen, or a managed clock. The product records this in its known issues and its threat model as the sharpest edge here.

Approvals cannot be single-use offline. Whether an approval has been consumed is true as of issuance and nothing on the device can update it, so within one bundle’s freshness window a granted approval can be spent twice. The same shape allows rollback inside the window: an older bundle that is still fresh still verifies, and refusing a downgrade needs a hook that remembers the highest version it has seen. Both are runner state that has not been built, and both are stated rather than implied.

The artifact itself is weaker than a production endpoint agent should be. It ships as a Node command rather than a code-signed, notarised native binary across macOS, Windows and Linux — that work has not been done, and an unsigned executable delivered by device management is a weaker artefact than a signed one. The local evidence spool is unsigned, so a root user can delete a record or recompute its hash before collection; a real attestation claim needs a hardware-protected device key or a privileged collector, and this process has neither. The spool append is synchronous, and operating systems do not make writes to an ordinary regular file deadline-bounded, so pathological local storage can delay an already-computed refusal until the vendor’s own timeout.

The vendor is the last word on the subscription itself. Token Observe can retire a seat and revoke the credential it issued, which stops the seat reaching Token Observe and stops bundles being issued for it; the API says so in the response rather than leaving a console to imply otherwise. It cannot end the entitlement — it never held that credential — so the vendor admin console is the other half of an off-boarding, every time.

The managed-settings artifacts are generated from each vendor’s published documentation, with the URL each key was checked against recorded beside it and a linter that warns when an artifact carries a key that could not be sourced. Nothing in that generator has been exercised against a running vendor client, and it says so. Prove one seat per vendor before an estate depends on it — and note that Claude Code’s managed sources do not merge: it applies the first source that delivers a non-empty configuration, so shipping two per device means one is enforced and the other silently ignored.