Hubspot Agent Governance Runtime

Workflow

1. Identify the trigger surface — determine which hook event (PreToolUse, PostToolUse, Stop) owns the decision. Check plugin.json hook matchers against the tool name pattern.
2. Classify the operation risk — apply the matrix above. Critical and High operations require explicit gate logic in the hook script.
3. Implement the gate — in the hook shell script, parse $CLAUDE_TOOL_INPUT JSON, validate against required agent context (agent_type from hook JSON), and emit a structured block or warn decision to stdout.
4. Validate strict-mode flag — check HUBSPOT_STRICT_MODE env var; when set, demote all "warn" decisions to "block".
5. Capture the audit trail — append a JSON record {ts, tool, decision, agent, reason} to logs/governance-audit.jsonl.
6. Verify rollback path — confirm the hook exits cleanly on bypass and that the audit log captures the override identity.

Routing Boundaries

Use this skill for hook enforcement and governance policy only. Defer to hubspot-governance-patterns for org-wide policy design and to hubspot-hook-input-contracts for input parsing standards.

References

• Task Safety Gating
• Agent Validation Logic
• Strict Mode and Bypass Policy