dsh-gov

When enterprise teams bring DSH into production, the first three questions are always the same: who is allowed to let an agent call high-risk tools, how do you trace an incident, and where does the token spend land. dsh-gov bundles all three into a single plugin, keeping governance logic decoupled from business code while staying completely non-blocking for agent execution.

The core capabilities revolve around three modules: policy gates let you configure allow, deny, or ask rules per tool, agent, or workspace, with wildcards and priority for flexible composition, failing closed (deny over ask over allow) on ties to guarantee a safety floor; every tool invocation decision and result is appended to a structured JSONL audit log, filterable by agent, tool, or time window, and exportable straight into compliance pipelines; token quotas plug into the host meter, setting day, week, month, or total budgets per agent, with automatic context warnings on exceedance and one-click resets.

If you are building enterprise-grade permission boundaries, audit trails, or cost guardrails for DSH, and you want these capabilities to live in zero-dependency, unit-testable logic layers, work globally across workspaces, and never block an agent on failure, dsh-gov is the layer you need.