npm - thumbgate - Versions diffs - 1.27.7 → 1.27.9 - Mend

thumbgate 1.27.7 → 1.27.9

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (106) hide show

package/.well-known/llms.txt +1 -2
package/README.md +0 -2
package/bin/cli.js +259 -78
package/package.json +12 -18
package/public/blog.html +30 -0
package/public/compare/adopt-ai.html +219 -0
package/public/compare/agentix-labs.html +197 -0
package/public/compare/ai-experience-orchestration.html +216 -0
package/public/compare/anthropic-claude-for-legal.html +260 -0
package/public/compare/anthropic-containment.html +280 -0
package/public/compare/arcade.html +175 -0
package/public/compare/arcjet.html +239 -0
package/public/compare/bumblebee.html +307 -0
package/public/compare/claude-code-hooks.html +294 -0
package/public/compare/databricks-unity-ai-gateway.html +215 -0
package/public/compare/fallow.html +351 -0
package/public/compare/heidi.html +233 -0
package/public/compare/mem0.html +342 -0
package/public/compare/oak-and-sparrow-gatekeeper.html +289 -0
package/public/compare/rein.html +236 -0
package/public/compare/sigmashake.html +256 -0
package/public/compare/speclock.html +342 -0
package/public/compare.html +2 -0
package/public/guides/agent-harness-optimization.html +342 -0
package/public/guides/agentic-web-governance.html +406 -0
package/public/guides/ai-agent-governance-sprint.html +415 -0
package/public/guides/ai-agent-pre-action-approval-gates.html +401 -0
package/public/guides/ai-agent-workflow-migration-checklist.html +392 -0
package/public/guides/ai-deployment-readiness.html +415 -0
package/public/guides/ai-mode-ads-agent-governance.html +401 -0
package/public/guides/ai-search-topical-presence.html +342 -0
package/public/guides/autoresearch-agent-safety.html +342 -0
package/public/guides/background-agent-governance.html +358 -0
package/public/guides/best-tools-stop-ai-agents-breaking-production.html +363 -0
package/public/guides/browser-automation-safety.html +342 -0
package/public/guides/chatgpt-ads-trust.html +353 -0
package/public/guides/claude-code-feedback.html +339 -0
package/public/guides/claude-code-prevent-repeated-mistakes.html +161 -0
package/public/guides/claude-code-skills-guardrails.html +343 -0
package/public/guides/claude-desktop.html +356 -0
package/public/guides/code-knowledge-graph-guardrails.html +365 -0
package/public/guides/codex-cli-guardrails.html +339 -0
package/public/guides/cursor-agent-guardrails.html +339 -0
package/public/guides/cursor-prevent-repeated-mistakes.html +161 -0
package/public/guides/database-agent-safety.html +406 -0
package/public/guides/deepseek-v4-runtime-guardrails.html +346 -0
package/public/guides/developer-machine-supply-chain-guardrails.html +358 -0
package/public/guides/gcp-mcp-guardrails.html +147 -0
package/public/guides/gemini-cli-feedback-memory.html +339 -0
package/public/guides/gpt-5-5-model-evaluation.html +358 -0
package/public/guides/internal-ai-engineering-stack-guardrails.html +348 -0
package/public/guides/long-running-agent-context-management.html +346 -0
package/public/guides/mcp-tool-governance.html +401 -0
package/public/guides/multica-thumbgate-setup.html +134 -0
package/public/guides/native-messaging-host-security.html +342 -0
package/public/guides/policy-engine-pre-action-gates.html +346 -0
package/public/guides/pre-action-checks.html +342 -0
package/public/guides/pretooluse-hooks-vs-advisory-prompt-rules.html +342 -0
package/public/guides/prompt-tricks-to-workflow-rules.html +365 -0
package/public/guides/proxy-pointer-rag-guardrails.html +352 -0
package/public/guides/rag-precision-tuning-guardrails.html +352 -0
package/public/guides/reasoning-compression-guardrails.html +346 -0
package/public/guides/relational-knowledge-ai-recommendations.html +342 -0
package/public/guides/roo-code-alternative-cline.html +339 -0
package/public/guides/semantic-programmatic-seo-guardrails.html +352 -0
package/public/guides/seo-agent-skills-guardrails.html +344 -0
package/public/guides/stop-repeated-ai-agent-mistakes.html +342 -0
package/public/index.html +10 -48
package/public/learn/ac-dc-runtime-enforcement.html +277 -0
package/public/learn/agent-harness-pattern.html +181 -0
package/public/learn/agent-swarms-shared-gates.html +173 -0
package/public/learn/agentic-enterprise-context-brain.html +117 -0
package/public/learn/agentic-os-team-governance.html +146 -0
package/public/learn/ai-agent-governance.html +158 -0
package/public/learn/ai-agent-persistent-memory.html +211 -0
package/public/learn/background-agent-control-layer.html +184 -0
package/public/learn/claude-code-goal-with-rubrics.html +205 -0
package/public/learn/codex-role-plugins-need-governance.html +125 -0
package/public/learn/cost-aware-agent-gate-routing.html +173 -0
package/public/learn/databricks-unity-ai-gateway-runtime-governance.html +157 -0
package/public/learn/deterministic-agent-workflows.html +185 -0
package/public/learn/feedback-loop-vs-decision-layer.html +283 -0
package/public/learn/from-prototype-to-production.html +223 -0
package/public/learn/learn.css +51 -0
package/public/learn/mcp-pre-action-checks-explained.html +172 -0
package/public/learn/pretix-stripe-connect-marketplaces.html +161 -0
package/public/learn/regulated-agent-execution-boundary.html +196 -0
package/public/learn/spec-driven-development.html +168 -0
package/public/learn/stop-ai-agent-force-push.html +134 -0
package/public/learn/vibe-coding-safety-net.html +142 -0
package/public/learn.html +6 -50
package/public/pro.html +6 -6
package/scripts/cli-schema.js +10 -22
package/scripts/dashboard-chat.js +1 -2
package/scripts/document-intake.js +49 -1
package/scripts/gemini-embedding-policy.js +1 -2
package/scripts/hosted-config.js +12 -0
package/scripts/plausible-domain-config.js +1 -3
package/scripts/reddit-browser-notification-watch.js +230 -0
package/scripts/seo-gsd.js +0 -239
package/scripts/vector-store.js +0 -44
package/scripts/workspace-evolver.js +2 -62
package/src/api/server.js +124 -335
package/adapters/policy-engine/ethicore-guardian-client.js +0 -68
package/adapters/policy-engine/thumbgate-policy-engine-adapter.js +0 -260
package/scripts/hook-stop-anti-claim.js +0 -227

package/public/guides/native-messaging-host-security.html ADDED Viewed

@@ -0,0 +1,342 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Native Messaging Host Security | Audit Browser Bridges Before They Expand</title>
+  <meta name="description" content="Native messaging hosts let browser extensions talk to local executables. That can be useful, but it also creates a persistent bridge outside the browser sand..." />
+  <meta property="og:title" content="Native Messaging Host Security | Audit Browser Bridges Before They Expand" />
+  <meta property="og:description" content="Native messaging hosts let browser extensions talk to local executables. That can be useful, but it also creates a persistent bridge outside the browser sand..." />
+  <meta property="og:type" content="article" />
+  <meta property="og:url" content="https://thumbgate.ai/guides/native-messaging-host-security" />
+  <link rel="canonical" href="https://thumbgate.ai/guides/native-messaging-host-security" />
+  <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
+  <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
+  <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
+  <meta property="og:image" content="/og.png" />
+  <style>
+    :root {
+      --bg: #0a0a0b;
+      --bg-raised: #111113;
+      --bg-card: #161618;
+      --line: #222225;
+      --text: #e8e8ec;
+      --muted: #8b8b96;
+      --cyan: #22d3ee;
+      --green: #4ade80;
+      --red: #f87171;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      line-height: 1.65;
+    }
+    a { color: var(--cyan); text-decoration: none; }
+    a:hover { text-decoration: underline; }
+    .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
+    .topbar {
+      position: sticky;
+      top: 0;
+      z-index: 20;
+      backdrop-filter: blur(12px);
+      background: rgba(10, 10, 11, 0.88);
+      border-bottom: 1px solid var(--line);
+    }
+    .topbar .container {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      padding-top: 14px;
+      padding-bottom: 14px;
+    }
+    .brand {
+      font-weight: 700;
+      color: var(--text);
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      text-decoration: none;
+    }
+    .brand .logo-mark { width: 28px; height: 28px; display: block; }
+    .hero { padding: 72px 0 32px; }
+    .eyebrow {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 6px 12px;
+      border-radius: 999px;
+      border: 1px solid rgba(34, 211, 238, 0.22);
+      background: rgba(34, 211, 238, 0.1);
+      color: var(--cyan);
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      font-size: 12px;
+      font-weight: 700;
+    }
+    h1 {
+      font-size: clamp(34px, 5vw, 56px);
+      line-height: 1.06;
+      letter-spacing: -0.04em;
+      margin: 16px 0;
+      max-width: 760px;
+    }
+    .hero p {
+      max-width: 720px;
+      color: var(--muted);
+      font-size: 18px;
+    }
+    .signal-row {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin: 28px 0 0;
+    }
+    .signal-pill {
+      display: inline-flex;
+      align-items: center;
+      gap: 8px;
+      padding: 10px 14px;
+      border-radius: 999px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      font-weight: 600;
+      font-size: 14px;
+    }
+    .signal-pill.up {
+      border-color: rgba(74, 222, 128, 0.28);
+      color: #b8f7c8;
+      background: rgba(74, 222, 128, 0.1);
+    }
+    .signal-pill.down {
+      border-color: rgba(248, 113, 113, 0.28);
+      color: #ffc0c0;
+      background: rgba(248, 113, 113, 0.1);
+    }
+    .grid {
+      display: grid;
+      grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr);
+      gap: 24px;
+      padding-bottom: 72px;
+    }
+    .card, .detail-section, .sidebar-card {
+      background: var(--bg-card);
+      border: 1px solid var(--line);
+      border-radius: 16px;
+    }
+    .card { padding: 24px; }
+    .detail-section { padding: 24px; margin-bottom: 18px; }
+    .detail-section h2 { margin: 0 0 12px; font-size: 24px; letter-spacing: -0.03em; }
+    .detail-section p { color: var(--muted); }
+    .detail-section ul, .card ul { padding-left: 18px; color: var(--muted); }
+    .card h2 { margin-top: 0; }
+    .sidebar {
+      display: flex;
+      flex-direction: column;
+      gap: 18px;
+    }
+    .sidebar-card {
+      padding: 20px;
+    }
+    /* Only the first sidebar card sticks. Stacking multiple stickies at the
+       same top offset makes them overlap each other on scroll. The related-
+       pages card flows normally below. */
+    .sidebar-card:first-child {
+      position: sticky;
+      top: 84px;
+      max-height: calc(100vh - 104px);
+      overflow-y: auto;
+      -webkit-overflow-scrolling: touch;
+    }
+    .proof-links {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 12px;
+      margin-top: 16px;
+    }
+    .cta-button {
+      display: inline-flex;
+      align-items: center;
+      justify-content: center;
+      margin-top: 18px;
+      padding: 12px 16px;
+      border-radius: 10px;
+      background: var(--cyan);
+      color: #071116;
+      font-weight: 700;
+      text-decoration: none;
+    }
+    .faq-item {
+      border-top: 1px solid var(--line);
+      padding: 14px 0;
+    }
+    .faq-item summary {
+      cursor: pointer;
+      font-weight: 600;
+    }
+    .faq-item p {
+      color: var(--muted);
+    }
+    .related-card {
+      display: block;
+      padding: 14px;
+      border-radius: 12px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      margin-top: 12px;
+      color: var(--text);
+    }
+    .related-label {
+      display: block;
+      color: var(--muted);
+      font-size: 12px;
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      margin-bottom: 4px;
+    }
+    @media (max-width: 860px) {
+      .grid {
+        grid-template-columns: 1fr;
+      }
+      .sidebar-card:first-child {
+        position: static;
+        max-height: none;
+        overflow: visible;
+      }
+    }
+  </style>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "Native messaging host security for AI browser bridges",
+  "description": "Native messaging hosts let browser extensions talk to local executables. That can be useful, but it also creates a persistent bridge outside the browser sand...",
+  "about": [
+    "claude code masterclass guardrails",
+    "cursor prevent repeated mistakes",
+    "claude code prevent repeated mistakes",
+    "codex cli guardrails"
+  ],
+  "url": "https://thumbgate.ai/guides/native-messaging-host-security",
+  "publisher": {
+    "@type": "Organization",
+    "name": "ThumbGate",
+    "url": "https://thumbgate.ai"
+  },
+  "mainEntityOfPage": "https://thumbgate.ai/guides/native-messaging-host-security"
+}
+  </script>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "FAQPage",
+  "mainEntity": [
+    {
+      "@type": "Question",
+      "name": "Why does native messaging deserve a separate security review?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "Because it lets a browser extension hand work to a local executable outside the browser sandbox. That is a different trust boundary than ordinary page automation or side-panel UI access."
+      }
+    },
+    {
+      "@type": "Question",
+      "name": "How does ThumbGate help with native messaging host security?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "ThumbGate audits known host locations, highlights AI/browser bridges, flags stale or missing host binaries, and gives teams an enforcement layer so future connector expansion requires explicit approval."
+      }
+    }
+  ]
+}
+  </script>
+</head>
+<body>
+  <div class="topbar">
+    <div class="container">
+      <a class="brand" href="/"><img src="/assets/brand/thumbgate-mark-inline.svg" alt="ThumbGate" class="logo-mark" width="28" height="28"><span class="logo-text">ThumbGate</span></a>
+      <a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a>
+    </div>
+  </div>
+  <main class="container">
+    <section class="hero">
+      <div class="eyebrow">guide | native messaging host security</div>
+      <h1>Native messaging host security for AI browser bridges</h1>
+      <p>Native messaging hosts let browser extensions talk to local executables. That can be useful, but it also creates a persistent bridge outside the browser sandbox. ThumbGate audits those registrations and helps teams require explicit approval before they become part of the workflow.</p>
+      <div class="signal-row">
+        <div class="signal-pill up">👍 Thumbs up reinforces good behavior</div>
+        <div class="signal-pill down">👎 Thumbs down blocks repeated mistakes</div>
+      </div>
+    </section>
+    <section class="grid">
+      <div>
+        <div class="card">
+          <h2>Why this page exists</h2>
+          <ul><li>Native messaging is a real local capability boundary, not a harmless implementation detail.</li><li>A manifest can pre-authorize extension origins long before a human operator understands the blast radius.</li><li>ThumbGate turns native messaging review into an auditable operator workflow instead of an invisible local side effect.</li></ul>
+        </div>
+      <section class="detail-section">
+        <h2>What native messaging hosts actually do</h2>
+        <p>A native messaging host is a local manifest that tells a browser extension which executable it may launch on the operator machine. That bridge sits outside the browser sandbox, so it deserves the same review discipline teams use for deploy credentials or production write access.</p><p>The risk is not only the host binary itself. It is the combination of extension permissions, allowed origins, and whether the host remains registered for browsers the operator did not intentionally connect.</p>
+      </section>
+      <section class="detail-section">
+        <h2>Signals ThumbGate audits</h2>
+        <ul><li>Manifest files under browser-specific NativeMessagingHosts directories on macOS and Linux.</li><li>Allowed extension origins and extension-id fan-out per host registration.</li><li>Host binaries that are missing on disk, which leaves stale or broken registrations behind.</li><li>AI/browser bridge manifests registered for browsers not detected in the usual local install paths.</li></ul>
+      </section>
+      <section class="detail-section">
+        <h2>The fastest operator action</h2>
+        <p>Run npx thumbgate native-messaging-audit --json in the repo or workstation you govern. Review every AI browser bridge, remove anything you did not intentionally integrate, and keep browser-use in ask-before-acting mode until connector scope is explicit and revocable.</p>
+      </section>
+        <div class="detail-section">
+          <h2>FAQ</h2>
+      <details class="faq-item">
+        <summary>Why does native messaging deserve a separate security review?</summary>
+        <p>Because it lets a browser extension hand work to a local executable outside the browser sandbox. That is a different trust boundary than ordinary page automation or side-panel UI access.</p>
+      </details>
+      <details class="faq-item">
+        <summary>How does ThumbGate help with native messaging host security?</summary>
+        <p>ThumbGate audits known host locations, highlights AI/browser bridges, flags stale or missing host binaries, and gives teams an enforcement layer so future connector expansion requires explicit approval.</p>
+      </details>
+        </div>
+      </div>
+      <aside class="sidebar">
+        <div class="sidebar-card">
+          <h2>GSD execution brief</h2>
+          <p>This page was prioritized because it captures high-intent demand around native messaging host security and feeds directly into ThumbGate's proof-led conversion path.</p>
+          <p><strong>Opportunity score:</strong> 75</p>
+          <p><strong>Primary persona:</strong> ai-engineer</p>
+          <p><strong>Keyword cluster:</strong> claude code masterclass guardrails, cursor prevent repeated mistakes, claude code prevent repeated mistakes, codex cli guardrails</p>
+          <p><strong>Pricing:</strong> Pro $19/mo or $149/yr. Team $49/seat/mo.</p>
+          <div class="proof-links"><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/docs/VERIFICATION_EVIDENCE.md" target="_blank" rel="noopener">Verification evidence</a><a href="https://github.com/IgorGanapolsky/ThumbGate/blob/main/proof/automation/report.json" target="_blank" rel="noopener">Automation proof</a><a href="https://github.com/IgorGanapolsky/ThumbGate" target="_blank" rel="noopener">GitHub repository</a></div>
+          <a class="cta-button" href="/checkout/pro?utm_source=website&amp;utm_medium=seo_page&amp;utm_campaign=guides_native-messaging-host-security&amp;cta_placement=seo_brief&amp;plan_id=pro" target="_blank" rel="noopener">Go Pro — $19/mo</a>
+        </div>
+        <div class="sidebar-card">
+          <h2>Related pages</h2>
+        <a class="related-card" href="/guides/browser-automation-safety">
+          <span class="related-label">Related page</span>
+          <strong>Browser automation safety needs explicit approval boundaries</strong>
+        </a>
+        <a class="related-card" href="/guides/pre-action-checks">
+          <span class="related-label">Related page</span>
+          <strong>What Are Pre-Action Checks?</strong>
+        </a>
+        </div>
+      </aside>
+    </section>
+  </main>
+</body>
+</html>

package/public/guides/policy-engine-pre-action-gates.html ADDED Viewed

@@ -0,0 +1,346 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Policy Engines Need Pre-Action Gates for AI Agents | ThumbGate</title>
+  <meta name="description" content="Policy engines, guardrail SDKs, and compliance APIs can decide whether an AI-agent action is allowed. ThumbGate enforces that decision locally before the tool runs." />
+  <meta property="og:title" content="Policy Engines Need Pre-Action Gates for AI Agents | ThumbGate" />
+  <meta property="og:description" content="Policy engines decide. ThumbGate enforces before shell, file, MCP, browser, deploy, or API actions run." />
+  <meta property="og:type" content="article" />
+  <meta property="og:url" content="https://thumbgate.ai/guides/policy-engine-pre-action-gates" />
+  <link rel="canonical" href="https://thumbgate.ai/guides/policy-engine-pre-action-gates" />
+  <link rel="llm-context" href="/llm-context.md" type="text/markdown" />
+  <link rel="icon" type="image/svg+xml" href="/thumbgate-icon.png" />
+  <link rel="apple-touch-icon" href="/assets/brand/thumbgate-mark.svg" />
+  <meta property="og:image" content="/og.png" />
+  <style>
+    :root {
+      --bg: #0a0a0b;
+      --bg-raised: #111113;
+      --bg-card: #161618;
+      --line: #222225;
+      --text: #e8e8ec;
+      --muted: #9b9ba6;
+      --cyan: #22d3ee;
+      --green: #4ade80;
+      --red: #f87171;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+      background: var(--bg);
+      color: var(--text);
+      line-height: 1.65;
+    }
+    a { color: var(--cyan); text-decoration: none; }
+    a:hover { text-decoration: underline; }
+    .container { max-width: 980px; margin: 0 auto; padding: 0 24px; }
+    .topbar {
+      position: sticky;
+      top: 0;
+      z-index: 20;
+      backdrop-filter: blur(12px);
+      background: rgba(10, 10, 11, 0.88);
+      border-bottom: 1px solid var(--line);
+    }
+    .topbar .container {
+      display: flex;
+      justify-content: space-between;
+      align-items: center;
+      padding-top: 14px;
+      padding-bottom: 14px;
+    }
+    .brand {
+      display: inline-flex;
+      gap: 8px;
+      align-items: center;
+      color: var(--text);
+      font-weight: 700;
+    }
+    .logo-mark { width: 28px; height: 28px; display: block; }
+    .hero { padding: 72px 0 32px; }
+    .eyebrow {
+      display: inline-flex;
+      padding: 6px 12px;
+      border-radius: 999px;
+      border: 1px solid rgba(34, 211, 238, 0.22);
+      background: rgba(34, 211, 238, 0.1);
+      color: var(--cyan);
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+      font-size: 12px;
+      font-weight: 700;
+    }
+    h1 {
+      max-width: 820px;
+      margin: 16px 0;
+      font-size: clamp(34px, 5vw, 56px);
+      line-height: 1.06;
+      letter-spacing: -0.04em;
+    }
+    .hero p {
+      max-width: 760px;
+      color: var(--muted);
+      font-size: 18px;
+    }
+    .signal-row { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 28px; }
+    .signal-pill {
+      padding: 10px 14px;
+      border-radius: 999px;
+      border: 1px solid var(--line);
+      background: var(--bg-raised);
+      font-size: 14px;
+      font-weight: 700;
+    }
+    .signal-pill.up { border-color: rgba(74, 222, 128, 0.28); color: #b8f7c8; background: rgba(74, 222, 128, 0.1); }
+    .signal-pill.down { border-color: rgba(248, 113, 113, 0.28); color: #ffc0c0; background: rgba(248, 113, 113, 0.1); }
+    .grid {
+      display: grid;
+      grid-template-columns: minmax(0, 2fr) minmax(280px, 1fr);
+      gap: 24px;
+      padding-bottom: 72px;
+    }
+    .card, .detail-section, .sidebar-card {
+      background: var(--bg-card);
+      border: 1px solid var(--line);
+      border-radius: 16px;
+    }
+    .card, .detail-section, .sidebar-card { padding: 24px; }
+    .detail-section { margin-bottom: 18px; }
+    .detail-section h2, .card h2, .sidebar-card h2 { margin: 0 0 12px; letter-spacing: -0.03em; }
+    .detail-section p, .card p, .sidebar-card p, li { color: var(--muted); }
+    ul { padding-left: 18px; }
+    table { width: 100%; border-collapse: collapse; margin-top: 16px; }
+    th, td { border: 1px solid var(--line); padding: 12px; vertical-align: top; text-align: left; }
+    th { color: var(--text); background: var(--bg-raised); }
+    code, pre {
+      font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace;
+      background: #0d1117;
+      color: #d6deff;
+      border: 1px solid var(--line);
+      border-radius: 10px;
+    }
+    code { padding: 2px 6px; }
+    pre { overflow-x: auto; padding: 16px; }
+    .sidebar { display: flex; flex-direction: column; gap: 18px; }
+    .sidebar-card:first-child {
+      position: sticky;
+      top: 84px;
+      max-height: calc(100vh - 104px);
+      overflow-y: auto;
+    }
+    .cta-button {
+      display: inline-flex;
+      justify-content: center;
+      margin-top: 18px;
+      padding: 12px 16px;
+      border-radius: 10px;
+      background: var(--cyan);
+      color: #071116;
+      font-weight: 700;
+    }
+    .related-card {
+      display: block;
+      padding: 14px;
+      margin-top: 12px;
+      border: 1px solid var(--line);
+      border-radius: 12px;
+      background: var(--bg-raised);
+      color: var(--text);
+    }
+    .related-label {
+      display: block;
+      color: var(--muted);
+      font-size: 12px;
+      text-transform: uppercase;
+      letter-spacing: 0.08em;
+    }
+    .faq-item { border-top: 1px solid var(--line); padding: 14px 0; }
+    .faq-item summary { cursor: pointer; font-weight: 700; }
+    @media (max-width: 860px) {
+      .grid { grid-template-columns: 1fr; }
+      .sidebar-card:first-child { position: static; max-height: none; }
+    }
+  </style>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "TechArticle",
+  "headline": "Policy Engines Need Pre-Action Gates for AI Agents",
+  "description": "Policy engines, guardrail SDKs, and compliance APIs can decide whether an AI-agent action is allowed. ThumbGate enforces that decision locally before the tool runs.",
+  "about": [
+    "AI agent policy engine",
+    "pre-action gates",
+    "OPA agent guardrails",
+    "Bedrock Guardrails agent tools",
+    "Guardian SDK agent governance"
+  ],
+  "url": "https://thumbgate.ai/guides/policy-engine-pre-action-gates",
+  "publisher": {
+    "@type": "Organization",
+    "name": "ThumbGate",
+    "url": "https://thumbgate.ai"
+  }
+}
+  </script>
+  <script type="application/ld+json">
+{
+  "@context": "https://schema.org",
+  "@type": "FAQPage",
+  "mainEntity": [
+    {
+      "@type": "Question",
+      "name": "Does ThumbGate replace a policy engine?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "No. A policy engine decides whether an action is allowed. ThumbGate enforces that decision before the agent executes a shell, file, MCP, browser, deploy, or API action."
+      }
+    },
+    {
+      "@type": "Question",
+      "name": "Can ThumbGate use Guardian SDK, Ethicore, OPA, or Bedrock Guardrails decisions?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "Yes. ThumbGate's policy-engine adapter normalizes allow, block, and approval-required outputs from external policy engines, then applies local pre-action gates before execution."
+      }
+    },
+    {
+      "@type": "Question",
+      "name": "Why not just log policy violations after the run?",
+      "acceptedAnswer": {
+        "@type": "Answer",
+        "text": "Post-run logging proves what happened after damage is possible. Pre-action gates stop the risky action before it runs and preserve the evidence for audit."
+      }
+    }
+  ]
+}
+  </script>
+</head>
+<body>
+  <header class="topbar">
+    <div class="container">
+      <a class="brand" href="/"><img class="logo-mark" src="/assets/brand/thumbgate-mark.svg" alt="" /> ThumbGate</a>
+      <a href="/pricing">Pricing</a>
+    </div>
+  </header>
+  <main class="container">
+    <section class="hero">
+      <span class="eyebrow">Policy engine adapter</span>
+      <h1>Policy engines decide. ThumbGate enforces before the agent acts.</h1>
+      <p>Guardian SDK, Ethicore-style policy layers, OPA, Bedrock Guardrails, and custom compliance APIs are useful decision systems. The missing piece is a deterministic local gate that catches the actual command, file edit, MCP call, browser action, deployment, or API request before it executes.</p>
+      <div class="signal-row">
+        <span class="signal-pill up">Use existing policy engines</span>
+        <span class="signal-pill up">Normalize allow/block/review</span>
+        <span class="signal-pill down">Do not rely on after-the-fact logs</span>
+      </div>
+    </section>
+    <section class="grid">
+      <div>
+        <div class="card">
+          <h2>The buyer objection</h2>
+          <p>"We already have a policy engine." Good. ThumbGate should sit underneath it, not compete with it. Policy engines answer whether an action is compliant. ThumbGate makes that answer operational at the exact moment an AI agent is about to touch a real system.</p>
+        </div>
+        <section class="detail-section">
+          <h2>Policy reasoning vs execution enforcement</h2>
+          <table>
+            <thead>
+              <tr>
+                <th>Layer</th>
+                <th>What it does</th>
+                <th>Failure if used alone</th>
+              </tr>
+            </thead>
+            <tbody>
+              <tr>
+                <td>Policy engine</td>
+                <td>Evaluates a rule, ontology, risk model, or compliance policy.</td>
+                <td>The agent can still execute if the decision is not wired into the tool boundary.</td>
+              </tr>
+              <tr>
+                <td>Audit log</td>
+                <td>Records what the agent did and why it was allowed or denied.</td>
+                <td>The record arrives after the risky action may already have run.</td>
+              </tr>
+              <tr>
+                <td>ThumbGate</td>
+                <td>Intercepts the concrete action locally before shell, file, MCP, deploy, browser, or API execution.</td>
+                <td>It needs policy input for teams that already maintain centralized governance models.</td>
+              </tr>
+            </tbody>
+          </table>
+        </section>
+        <section class="detail-section">
+          <h2>Adapter contract</h2>
+          <p>The adapter normalizes common policy-engine outputs into ThumbGate's enforcement shape.</p>
+          <pre><code>{
+  "decision": "block",
+  "reason": "off-scope network egress",
+  "policyId": "egress-001",
+  "evidence": [
+    { "ruleId": "egress-001", "reason": "curl to unknown host" }
+  ]
+}</code></pre>
+          <p>ThumbGate then treats that as a pre-action decision. If the policy says block, the wrapped tool does not execute. If the policy says allow but a local thumbs-down rule catches a repeated mistake, ThumbGate can still hard-block locally.</p>
+        </section>
+        <section class="detail-section">
+          <h2>Where this helps teams</h2>
+          <ul>
+            <li>Enterprises that already have compliance policies but no AI-agent tool boundary.</li>
+            <li>Platform teams exposing internal MCP tools to Claude Code, Cursor, Codex, Gemini CLI, OpenCode, or Letta agents.</li>
+            <li>Security teams that need proof that a risky command was stopped before execution.</li>
+            <li>Teams comparing policy SDKs, guardrails, and agent firewalls for production rollouts.</li>
+          </ul>
+        </section>
+        <section class="detail-section">
+          <h2>FAQ</h2>
+          <details class="faq-item">
+            <summary>Does ThumbGate replace a policy engine?</summary>
+            <p>No. A policy engine decides whether an action is allowed. ThumbGate enforces that decision before the agent executes a shell, file, MCP, browser, deploy, or API action.</p>
+          </details>
+          <details class="faq-item">
+            <summary>Can ThumbGate use Guardian SDK, Ethicore, OPA, or Bedrock Guardrails decisions?</summary>
+            <p>Yes. The policy-engine adapter normalizes allow, block, and approval-required outputs from external policy engines, then applies local pre-action gates before execution.</p>
+          </details>
+          <details class="faq-item">
+            <summary>Why not just log policy violations after the run?</summary>
+            <p>Post-run logging proves what happened after damage is possible. Pre-action gates stop the risky action before it runs and preserve the evidence for audit.</p>
+          </details>
+        </section>
+      </div>
+      <aside class="sidebar">
+        <div class="sidebar-card">
+          <h2>Implementation path</h2>
+          <p>Install ThumbGate, wrap the policy decision, and enforce the result before the agent's tool call runs.</p>
+          <pre><code>npx thumbgate init</code></pre>
+          <p><strong>Pricing:</strong> Pro $19/mo or $149/yr. Team $49/seat/mo.</p>
+          <a class="cta-button" href="/checkout/pro?utm_source=website&amp;utm_medium=seo_page&amp;utm_campaign=guides_policy_engine_pre_action_gates&amp;cta_placement=seo_brief&amp;plan_id=pro">Go Pro - $19/mo</a>
+        </div>
+        <div class="sidebar-card">
+          <h2>Related pages</h2>
+          <a class="related-card" href="/guides/mcp-tool-governance">
+            <span class="related-label">Related page</span>
+            <strong>MCP Tool Governance</strong>
+          </a>
+          <a class="related-card" href="/guides/ai-agent-pre-action-approval-gates">
+            <span class="related-label">Related page</span>
+            <strong>AI Agent Pre-Action Approval Gates</strong>
+          </a>
+          <a class="related-card" href="/guides/pretooluse-hooks-vs-advisory-prompt-rules">
+            <span class="related-label">Related page</span>
+            <strong>PreToolUse Hooks vs Advisory Prompt Rules</strong>
+          </a>
+        </div>
+      </aside>
+    </section>
+  </main>
+</body>
+</html>