# Recommended governance deployment patterns — pick the one that scores highest for your stack

AgentGovBench scores across seven frameworks, translated into a customer-facing recommendation for deploying governed AI agents by stack, score, and reach.

## tl;dr

After benchmarking seven AI agent frameworks against the same governance backend, one finding stands out:

**The integration pattern matters more than the framework brand.** Two CrewAI deployments and two LangGraph deployments score the same 40/48. An Anthropic Agent SDK deployment scores 46/48 — six scenarios of additional enforcement, just from a better-shaped wrapper.

This post is the customer-facing recommendation that follows: if you're picking how to deploy a governed agent, here's what the data says you should choose.

## The recommendation table

| You're building | Pick | Score | Why |
|---|---|---|---|
| Single-agent Claude tool-use loop in TypeScript | **Anthropic Agent SDK + `governHandlers`** | **46/48** | Native dispatch boundary, both fail modes honored |
| Multi-agent system with OpenAI/compatible models | **OpenAI Agents SDK + ACP base_url swap** | **45/48** | Proxy sits at request serialization boundary |
| Code-editing agent in your terminal | **Claude Code or Codex CLI + ACP hook** | **43/48** | Hook payload carries chain context |
| Multi-agent framework in Python (CrewAI/LangGraph) | **Decorator (`@governed`)** | **40/48** | Decorator-only (acp-crewai 0.1.0, acp-langchain 0.1.0); doesn't see framework orchestration |
| IDE-driven agent (Cursor) | MCP integration + **server-side mitigations** | **37/48** | MCP can't reach internal IDE tools — structural ceiling |

Underlying score data: [/benchmark](/benchmark) and [the full scorecard post](/blog/full-scorecard-seven-frameworks-48-scenarios).

## Pick by what you're trying to govern

**Governance over external API calls** (Slack, GitHub, Stripe, your own backend, customer data) — every pattern here covers this well. Pick on UX preference. The 40-46 range applies to the categories that matter for external-tool governance.

**Governance over agent delegation chains** (multi-agent systems where one agent spawns another) — proxy or hook pattern wins. Anthropic Agent SDK + governHandlers (46) or OpenAI Agents SDK + base_url swap (45) capture chain context cleanly. Decorator pattern (acp-crewai, acp-langchain) doesn't see that layer.

**Governance over code editing / file ops in an IDE** — none of the integration patterns fully reach here. IDE tools dispatch through the IDE's engine without serializing through any protocol an external governance layer can intercept. **You need server-side mitigations** (git hooks, branch protection, CI policies, network-layer enforcement) for these. ACP can't help directly.

**Governance over LLM cost / token usage** — orthogonal. ACP governs tool calls and actions, not LLM spend. Pair with Portkey, LiteLLM, or your provider's per-key budgets for cost attribution.

## Pick by the trust profile of who's using it

**Internal team, sophisticated users** — any pattern is fine. Hook patterns (Claude Code, Codex CLI) give the smoothest interactive UX. Trust-but-verify model.

**Internal team, non-technical users** — proxy or TS handler-wrapper. The user can't accidentally bypass network-layer governance the way they could disable a hook.

**External customers in a multi-tenant SaaS** — proxy pattern (45). Network-layer enforcement is hardest for customers to bypass, and per-agent attribution via headers is built for multi-tenancy.

**Compliance-heavy environments (regulated industries)** — proxy or TS handler-wrapper. Both score 45-46 and align with audit completeness, identity propagation, and per-user policy enforcement at near-ceiling. The compliance auditor citation story is cleanest with these.

**Coding agents on developer machines** — hook pattern. `--dangerously-skip-permissions` removes prompts but not hooks, so the hook keeps enforcing — [what the flag actually turns off](/blog/claude-code-dangerously-skip-permissions).

## When to choose Cursor anyway

Cursor + ACP scores 37/48 because of structural reasons — Cursor's internal tools never touch MCP. But **Cursor is still a great choice for many teams** if you understand the trade-off:

- The score reflects the IDE primitive operations (Edit, Read, Bash) that bypass MCP. **MCP-exposed tools (the external services you connect Cursor to) score the same as proxy-pattern integrations.**
- For external-service governance, Cursor + ACP MCP gives you full audit + policy + rate limits.
- For internal-tool governance, you need server-side mitigations regardless of which IDE you pick — this isn't unique to Cursor.

So: pick Cursor if you love the IDE, accept the 37/48 with eyes open, and add network-layer / git-layer policies for what MCP can't reach. The same caveat applies to **any IDE** that has internal tool primitives outside an external dispatch protocol.

## Migration path if you're already deployed

If you're running:

- **CrewAI in production** → stay. `acp-crewai` is decorator-only at 0.1.0, scoring 40/48. For now: prefer Sequential to Hierarchical Process, avoid checkpoint-heavy patterns.
- **LangGraph with checkpoint-heavy state** → review [the StateGraph governance gap post](/blog/langgraph-stategraph-checkpoint-governance-gap). Workarounds exist for the decorator-only integration.
- **Claude Code with `--dangerously-skip-permissions` use** → the hook still fires and a deny still blocks; write the deny rules before the flag is used. [Details](/blog/claude-code-dangerously-skip-permissions).
- **Cursor with ambient tool access** → audit which tools are MCP vs internal. Add server-side enforcement for the internal-tool surface. ACP's MCP server only governs what MCP carries.

## What this whole exercise tells us

Pattern shape determines the governance ceiling. Same gateway, seven frameworks, four patterns, four score tiers (37, 40, 43, 45-46). If governance score matters for your deployment, **pick the pattern that scores highest for your shape of agent** — single-agent loops use TS handler-wrapper, multi-agent systems use proxy, CLIs use hooks, IDE tools use MCP + server-side mitigations.

The framework is downstream of the pattern. Pick the pattern first.

If your shape is the coding agent, the hook pattern is one command:

```bash
curl -sf https://agenticcontrolplane.com/install.sh | bash
```

For the SDK shapes, start from the [integrations](/integrations).

---

**Receipts:**
- [/benchmark](/benchmark) — live scorecard
- [Full scorecard post](/blog/full-scorecard-seven-frameworks-48-scenarios) — every number with sources
- [Decorator vs proxy vs hook](/blog/decorator-proxy-hook-three-governance-patterns) — pattern theory