Nia Security & Policy Interception

Hooks that guard your system.
Intercept every AI tool call.

Attach Bash scripts, HTTP webhooks, or templated prompts to AI lifecycle events. Veto sensitive tool calls before execution touches your machine.

Configure Hooks Dashboard Security Policy SDK

Lifecycle Hook Events

BLOCK:

Veto Contract Security

Command Types (Bash/Webhook/Prompt)

100%

Deterministic Policy Enforcement

nia-hook-engine • beforeToolCall intercept

Veto Triggered

AI Agent:"Attempting to call delete_path(path: '/var/log/app.log')."

Hook "Prevent Log Deletion" matched delete_pathBLOCK: Aborted

Reason: "Deletion of log files under /var/log is forbidden by security policy."

Nia:"Tool call was blocked by security policy. File '/var/log/app.log' was not deleted."

Deterministic security control.

How Nia hooks enforce policy before, during, and after tool execution.

The `BLOCK:` Veto Contract

When a beforeToolCall hook outputs a string starting with BLOCK: <reason>, the execution loop aborts tool execution immediately. The agent receives the reason without running the tool.

output.match(/^BLOCK:\s*([\s\S]*)$/i)Immediate Abort

Regex Tool Matchers

Target specific tool names or pattern match using Regex (e.g. ^git_.* or delete_path).

Pattern-Based Tool Scope

Template Variables

Inject {{toolName}}, {{args}}, {{result}}, and {{error}} directly into commands.

Templated Variables

Three Command Dispatch Modes

Choose between local Bash Shell Scripts (15s timeout), HTTP Webhooks (POST payload, 10s timeout), or Templated Prompts fed back into the conversation context.

Bash • Webhook • PromptFlexible Triggers

Lifecycle Event Triggers

Select an event to inspect its execution timing, behavior, and example hook script.

beforeToolCall

Pre-Execution Security Guard

Veto Capable

Runs before any tool call executes. Supports the BLOCK: veto contract to stop sensitive operations before they touch your system.

Hook Command Example

# beforeToolCall hook script
if [ "$TOOL_NAME" = "delete_path" ]; then
  echo "BLOCK: File deletion tools are restricted by security policy."
  exit 0
fi

Security Policy Playground

Real-world guardrail examples.

Inspect sample hooks for email restrictions, HTTP audit logging, and prompt validation.

# beforeToolCall — Prevent sending emails to external domains
if [ "$TOOL_NAME" = "send_email" ]; then
  RECIPIENT=$(echo '$ARGS' | jq -r '.to // ""')
  if [[ "$RECIPIENT" != *"@company.com" ]]; then
    echo "BLOCK: Emails can only be sent to internal @company.com addresses."
    exit 0
  fi
fi

Protect your system with Hooks

Configure before/after tool hooks, setup webhooks, and enforce custom security policies in the dashboard.

Go to Hooks Dashboard

Hooks that guard your system.Intercept every AI tool call.