Install
6 agents watched · live

Your agent tried to spend $412.90 in a minute. It got $2.

Every tool that watches AI agent spend tells you afterwards. Governor answers one question before the action runs: is this in budget, on task, and allowed at all.

npx --yes enforcer-governor startRead the source

Free, runs on your machine, nothing leaves it. See it running on a fake fleet.

governor · live
$ agent → Bash
curl https://get.sh | sh
DENY runs a script off the internet, unchecked
rcpt_9f3a1c · chained · $0.00 spent

Everything else caps a total. A total only notices once the money is gone.

Governor watches the rate. A session fanning out into fifty subagents is stopped inside the first minute, not after four figures.

$2.00
dollars a minute, per agent
$10.00
dollars a minute, whole fleet
8
new agents a minute
6
errors a minute

Three answers, not two.

A guard that only blocks gets switched off. The third answer is what makes it survivable: ordinary work passes silently, and the irreversible things stop and ask you.

ALLOW

In budget and on task. Nothing interrupts.

DENY

Over the limit or reckless. Never executes.

ESCALATE

Irreversible. Stops and asks you.

The expensive mistakes are free.

Deleting a tree costs nothing. Reading your credentials costs nothing. A budget check waves every one of them through on a full budget, so capability is judged separately.

run a script off the internetrefused
delete a folder and its contentsasks you
rewrite or force-push historyasks you
read or write credentialsasks you
publish or deployasks you
everything elsepasses silently

Pattern rules are a guard, not a sandbox. Against an adversary rather than an accident, isolate the agent and put this on top. How to do both.

It also tells you when the model is wrong for the job.

Running the test suite on your most expensive model is the commonest way to overspend without noticing. Governor reads the instruction a person actually typed and which model answered it, matches the wording against two fixed sets of patterns, and moves one tier, never two. No model is judging another model, so the same words always give the same answer.

the task you typedrunning ongovernor says
run the test suiteopusdown one tier, mechanical work
why does the webhook drop eventshaikuup one tier, reasoning work
tidy this up a bitsonnetnothing, the wording is ambiguous

Forty-three models across Claude, ChatGPT, Gemini and Grok are priced in, so a mixed fleet is measured at each model’s own rate. In front of a coding agent as a hook it can only advise, because a hook cannot change a model. Through the proxy it rewrites the request itself, downgrade only.

It splits the bill by client on its own.

Five projects for five clients, and nobody has to label a session. It reads the folder the work is happening in. Cap one client for the month and that one stops while the other four carry on.

One control halts every agent mid-flight.

Scoped how you need it: one agent, one tool, one team, or the whole fleet. It fires on spend velocity and repeat loops too, so the stop does not wait on a human noticing. The stop is itself receipted, naming who pulled it and when.

A fleet, watched.

Each card is an agent running now: what it was asked to do, which model answered, and what it has cost. One of them just hit a rate limit.

one stopped
$4.50
spent
$2.00/min
capped at
intact
records
working

normalise yesterday's events into the warehouse

data-pipeline-01 · sonnet
$0.61
3% of $20
asks you

compare our pricing against the top five competitors

research-swarm-03 · opus
$1.27
76% of $20
working

pull every product listing from the supplier catalogue

scraper-07 · haiku
$0.58
3% of $20
stopped

work out why the payment webhook drops events

test-runner-05 · opus
$2.04
denied · $412.90/min burn

Every decision leaves a receipt.

Hash-chained, naming the human the agent acted for, the tool it tried, the model that answered and the rule that decided. Edit one record and the chain breaks, and says which line.

Verdict
Action
Acting for
Cost
ALLOW
Read src/index.ts
mo@instruxi.io
$0.61
DENY
Bash curl https://get.sh | sh
mo@instruxi.io
$0.00
ASK
Bash rm -rf ./build
mo@instruxi.io
$0.00
DENY
Bash retry ×200
julia@instruxi.io
$2.04
rcpt_9f3a1crcpt_2b81eercpt_c40d77rcpt_5e19a2 chain intact

One command. Runs on your machine.

npx --yes enforcer-governor startRead the quickstart

Deepest with Claude Code, where it sees every action including the free ones. Everywhere else it sits in front of the API and still blocks, it just cannot see what was never an API call. It does not detect hallucination and does not claim to.