review-agent-governance — Setup

Gate AI agent review actions (PR reviews, comments, merges, CI edits) behind

explicit human approval. Every attempt, approved or denied, produces an

Ed25519-signed receipt.

When to use this plugin

Install it in projects where a Claude Code agent:

• Reviews, comments on, or merges pull requests (gh pr review, gh pr merge)

• Triages issues (gh issue comment, gh issue close)

• Publishes releases (gh release create)

• Modifies CI configuration (.github/workflows/, .gitlab-ci.yml)

• Pushes to protected branches (main, master, release, production)

• Posts to external notification surfaces (Slack webhooks, Discord)

If the agent is only doing local file edits and running tests, this plugin is

overkill. Use protect-mcp for general tool-call policy enforcement and skip

this one.

One-time setup

1. Install the plugin

claude plugin install wshobson/agents/review-agent-governance

2. Copy the default policy to your project

cp .claude/plugins/review-agent-governance/policies/review-agent-governance.cedar \

   ./review-governance.cedar

You can edit this file to match your project's specific rules. See

../agents/review-policy-author.md for guidance on authoring review

policies.

3. Create a receipts directory and sign key

mkdir -p ./review-receipts

echo "./review-receipts/" >> .gitignore

echo "./review-governance.key" >> .gitignore

echo "./.review-approved" >> .gitignore

The first invocation of protect-mcp sign will create the key. Commit the

public key from the first receipt so auditors can verify later.

Per-session workflow

The Cedar policy denies review-surface actions unconditionally. To approve

a specific action, open an approval window before it and close it after.

Flag file (simplest)

# Before the action you want to approve

touch ./.review-approved

# Let Claude Code run the review / comment / merge

# Immediately after

rm ./.review-approved

Slash command (from within Claude Code)

/approve-review "Reviewing PR #123 authored by contributor X"

This creates ./.review-approved with the given reason embedded as a note,

and writes a human-approved receipt to the chain. A follow-up rm is still

needed to close the window.

Dry-run everything (force full policy evaluation)

If you want every tool call to go through Cedar with no approval bypass:

export REVIEW_APPROVAL_FLAG=./.never-approve

Any tool call matching a forbid rule will be denied; approved windows have

no effect. Useful for CI or for a locked-down audit run.

Verifying the chain

List all receipts:

ls -la ./review-receipts/

Verify the entire chain offline:

npx @veritasacta/verify ./review-receipts/*.json

Exit 0 means every receipt is authentic and the chain is intact. Exit 1

means one receipt has been tampered with. Exit 2 means a receipt is

malformed.

Look at recent denials:

/list-pending

Within Claude Code this slash command walks the receipt chain and prints

any recent decision: deny entries with the tool name, command pattern,

and timestamp.

Example: approving a PR review

# 1. Human reviews the agent's proposed comment

$ /list-pending

  Recent denials:

  - 2026-04-17T14:23:01Z  Bash "gh pr review 42 --approve --body 'LGTM'"

  - 2026-04-17T14:23:02Z  Bash "gh pr comment 42 --body 'Looking good'"

# 2. Human decides the first one is appropriate, approves it

$ /approve-review "Approving LGTM on PR 42 after visual inspection"

  ./.review-approved created

# 3. Agent retries the action; this time it succeeds

$ agent: gh pr review 42 --approve --body "LGTM"

  [receipt: rec_XXX, decision=allow, reason=human_approved]

# 4. Human closes the window

$ rm ./.review-approved

Every step is in the receipt chain. The chain is offline-verifiable for

regulators, counterparties, or downstream auditors who want to confirm

that no review action bypassed the human gate.

Composing with protect-mcp

If both plugins are installed, run them side by side:

{

  "hooks": {

    "PreToolUse": [

      {

        "matcher": ".*",

        "hooks": [

          {

            "type": "command",

            "command": "npx protect-mcp@0.5.5 evaluate --policy ./protect.cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\" --fail-on-missing-policy false"

          }

        ]

      },

      {

        "matcher": ".*",

        "hooks": [

          {

            "type": "command",

            "command": "if [ -f ./.review-approved ]; then exit 0; fi; npx protect-mcp@0.5.5 evaluate --policy ./review-governance.cedar --tool \"$TOOL_NAME\" --input \"$TOOL_INPUT\" --fail-on-missing-policy false"

          }

        ]

      }

    ]

  }

}

Both hooks must pass for the tool call to proceed. Cedar deny in either

policy blocks it.

Standards

• Ed25519 — RFC 8032 (digital signatures)

• JCS — RFC 8785 (deterministic JSON canonicalization)

• Cedar — AWS's open authorization policy language

• IETF draft — draft-farley-acta-signed-receipts