Skip to main content
AI coding assistants are local agent runtimes. They do not only produce text. They read files, assemble repository context, send prompts and tool schemas to remote model APIs, receive tool-call requests, run local tools, write files, and preserve session history. That operating model creates a new security boundary on every developer workstation.

The gap

Most assistant controls are local to one tool and one machine:
  • Prompt instructions steer behavior, but they do not enforce policy.
  • Runtime approvals reduce friction for one developer, but they accumulate as local state.
  • Hook systems are powerful, but deployment and failure behavior differ by tool.
  • Sandbox settings are session-scoped and product-specific.
  • Provider logs show API requests, but they do not show local file changes or approvals.
At team scale, this leaves security teams with fragmented evidence:
  • The model provider knows that a request happened.
  • The assistant transcript knows that a tool call happened.
  • Git or the filesystem knows that files changed.
  • Local approval files know which patterns are currently allowed.
Rye exists to connect those records and enforce policy outside any single assistant.

Rye’s control point

Rye supervises the workstation layer around the assistant:
  • The process wrapper sees session start and end, terminal output, approval text, and file changes.
  • The local proxy sees model traffic before it reaches the provider.
  • The policy engine can allow, deny, or mark requests as approval-required before forwarding.
  • The history ingester reads existing assistant transcript stores.
  • The daemon uploads normalized events to the control plane.
This gives teams a consistent governance layer across Claude Code, Codex CLI, Cursor, Windsurf, and future tools.

What Rye helps prove

Rye is designed to answer operational questions:
  • What exactly left the workstation?
  • Which policy revision evaluated the request?
  • Which model, domain, path, and user agent were involved?
  • Which local process and device produced the event?
  • Which files changed during the same session?
  • Which approvals were granted, and did they create persistent rules?
The goal is not to block AI coding tools. The goal is to make their real operating boundary visible, enforceable, and auditable.
For a practical rollout, start with one wrapped CLI on one test workstation. Capture only model API domains, verify TLS trust, inspect metadata first, then expand policy and retention.