Native agent permissions vs Shield KYA
Short answer: Native permissions decide what one agent may do. Shield KYA records what your agents did, in one trail, and adds a short never-list. Use native permissions to block. Add Shield KYA when you need one record across agents.
Shield KYA is an open-source audit trail and policy gate for AI coding agents, for teams who need to see and stop what agents run on developer machines.
Comparison
| Claude Code | Cursor | Codex | Shield KYA | |
|---|---|---|---|---|
| How it decides | Allow, ask and deny rules. Deny is checked first. | Terminal commands need approval by default. An allowlist and an Auto-review classifier. | A sandbox mode and an approval policy. | Open-source CLI: records each call and blocks only a short never-list. Hosted workspace (preview): enforces policy and holds actions for human approval. |
| Hooks before a call | PreToolUse hooks | beforeShellExecution and beforeMCPExecution hooks can block |
Not on the cited page | A pre-tool hook in Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Grok and Kimi Code. The MCP gate in Cursor. |
| Sandbox | Yes, for file and network access | Not on the cited page | Yes. Network access is off by default. | No sandbox by default |
| Admin control | Managed settings that users cannot override | Enterprise teams can sync hooks to all members | Enterprise admins can set managed configuration | Hosted workspace (preview) |
| Audit data | OpenTelemetry events, including each tool decision | Not on the cited page | Opt-in OpenTelemetry | A local trail, dashboard and receipt of each call |
| On error | Not on the cited page | Cursor calls its allowlist and classifier "best-effort guardrails rather than a hard security boundary" | Not on the cited page | Open-source CLI fails open. Hosted workspace fails closed. |
| Scope | Claude Code | Cursor | Codex | Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Grok and Kimi Code through hooks, and Cursor through MCP, in one trail |
Trade-offs
- Native permissions block reliably inside their own agent. Each agent has its own settings format and its own logs.
- Shield KYA gives one record across agents. The open-source CLI is advisory, so do not remove your native deny rules.
- The Shield KYA never-list blocks a short set of destructive commands, secret reads and exfiltration. It does not replace a sandbox.
- The hosted workspace (preview) enforces policy and fails closed. It needs an account.
What Shield KYA does
- The open-source CLI (
@shield-agent/kya, MIT license) records the tool calls of your coding agents in a local trail and a local dashboard. - The CLI is advisory and fails open on internal error. Its local hook blocks only a short never-list and a guard pack: destructive shell commands, secret reads and exfiltration. It records all other calls and does not block them.
- The hosted workspace (preview) enforces policy, holds actions for human approval in its console, and fails closed.
- A pre-tool hook sees each tool call that the agent sends through it in Claude Code, Codex, Gemini CLI, GitHub Copilot CLI, Grok and Kimi Code. In Cursor, Shield KYA sees the calls that go through its MCP gate. It does not see agents that never call it.
- It does not screen prompts or model output. Use a guardrails product for that.
FAQ
Do I need Shield KYA if I already set deny rules?
Not to block. Your deny rules block in that agent. Shield KYA helps when you need one record of what your agents ran, or human approval across agents.
Does Shield KYA change my native permission settings?
For Claude Code, kya start merges a hook into ~/.claude/settings.json. It does not remove your rules.
Why does the open-source CLI fail open?
So that a KYA error never stops a developer's agent. Only the never-list blocks. Enforcement that fails closed is in the hosted workspace.