Ship autonomous agents with enforceable guardrails¶

The problem¶

Your AI agents call tools, browse the web, query databases, and delegate to other agents. Once deployed, they make decisions autonomously. You need answers to three questions:

1. Is this action allowed? An agent with access to send_email and query_database should not be able to drop_table. OAuth scopes and IAM roles control which services an agent can reach, not what it does once connected.

2. Which agent did this? In a multi-agent system, five agents might share a single API key. When something goes wrong, "an agent did it" is not an incident response.

3. Can you prove what happened? Auditors and regulators need tamper-evident records of every decision: what policy was active, what the agent requested, and why it was allowed or denied.

Start with governance in 2 lines¶

Wrap a tool function with govern() for the shortest application integration. This is the current AgentMesh convenience API. New hosts, adapters, and platform policy integrations should use ACS.

from agentmesh.governance import govern

safe_tool = govern(my_tool, policy="policy.yaml")

On every call, safe_tool evaluates the YAML policy, logs the decision to an audit trail, and raises GovernanceDenied when the policy blocks the action. Because it wraps a callable, the same pattern works with tools from LangChain, CrewAI, OpenAI Agents, AutoGen, Google ADK, and any other framework.

# policy.yaml
apiVersion: governance.toolkit/v1
name: production-policy
default_action: allow
rules:
  - name: block-destructive
    condition: "action.type in ['drop', 'delete', 'truncate']"
    action: deny
    description: "Destructive operations require human approval"

  - name: require-approval-for-send
    condition: "action.type == 'send_email'"
    action: require_approval
    approvers: ["security-team"]

>>> safe_tool(action="read", table="users")
{'table': 'users', 'rows': 42}

>>> safe_tool(action="drop", table="users")
GovernanceDenied: Action denied by policy rule 'block-destructive':
  Destructive operations require human approval

ACS is the policy decision layer¶

Agent Control Specification, or ACS, is the canonical AGT 5 policy decision runtime. At each lifecycle event, the host sends ACS a complete snapshot, receives a verdict, and applies it at the corresponding intervention point.

pip install agent-control-specification

from agent_control_specification import AgentControl, HostSession

control = AgentControl.from_path("manifest.yaml")
session = HostSession(control, agent_id="researcher", session_id="session-1")

result = session.pre_tool_call(
    tool_name="send_email",
    args={"to": "partner@example.net", "body": "Status update"},
)

if not result.verdict.decision.permits:
    raise PermissionError(result.verdict.reason)

ACS returns one of five normalized verdicts: allow, warn, deny, escalate, or transform. ACS neither executes the tool nor retains hidden session state, so framework adapters, gateways, and custom hosts can share the same portable policy contract.

Run examples/acs-email-tool from a repository checkout, or follow the step-by-step ACS tutorial.

How it works¶

flowchart LR
    A["Agent framework"] --> H["AGT host or adapter"]
    H -->|Complete snapshot| ACS["ACS policy decision layer<br>Rego · Cedar · custom"]
    ACS -->|Normalized verdict| H
    H -->|Allow or transformed action| T["Tool executes"]
    H -->|Deny or escalate| B["Block or approval"]
    ID["Identity and trust"] --> H
    H --> AL["Tamper-evident audit"]
    HV["Runtime isolation"] --> T

ACS returns the decision; the host applies it. Identity and audit supply context and evidence, while runtime isolation controls execution. These layers do not change the ACS decision contract.

Architecture and package families¶

ACS policy decision layer Portable manifests, intervention points, and fail-closed verdicts Python Toolkit Recommended install for the complete governance stack Python Core Policy, trust, identity, audit, and runtime primitives Framework Integrations Optional adapters for major agent frameworks CLI and Operations Operator tooling, SRE, sandboxing, and MCP trust Protocol Governance MCP, A2A, receipts, and trust protocol surfaces

Language SDKs¶

Framework Integrations¶

Use govern() to wrap application callables. For framework lifecycle hooks, hosts use the native ACS Python SDK to build snapshots and enforce verdicts. Optional adapters cover LangChain, CrewAI, OpenAI Agents, LangGraph, LlamaIndex, Haystack, PydanticAI, and Google ADK. See the package guide.

Examples¶

Specifications and design contracts¶

These documents define runtime and interoperability contracts. Each page states its status; listing it here does not imply that every implementation conforms.

Architecture Decision Records document the reasoning behind key design choices.

Compliance mappings¶