Developers

You do not need
to replace your agent.

You place an independent execution-control boundary before state-changing actions. One synchronous call at the plan → act boundary returns a deterministic verdict before anything is issued.

The service never executes your tools. It evaluates the proposed call as JSON and returns an authorization decision.

Developer quickstart →Try Live Demo →
Integration surface

One endpoint. One decision.

Request — POST /v1/evaluatehttp
POST {GOVERNANCE_URL}/v1/evaluate
Authorization: Bearer {GOVERNANCE_TOKEN}
Content-Type: application/json

{
  "trajectory": [
    { "tool": "transfer_funds",
      "args": { "amount": 50000, "to": "acct_991" } }
  ],
  "domains": ["finance"]
}
Response — BLOCKjson
{
  "verdict": "BLOCK",           // PERMIT | ESCALATE | BLOCK
  "permitted": false,           // execute only when true
  "layer": "V5+",
  "reason": "Ω violation: finance_high_value_unverified_transfer",
  "omega_domain": "finance",
  "trajectory_hash": "9f3c1a8e7b22",
  "attestation": {
    "engine_commit": "96ecd39…",
    "ruleset_hash": "7b1f…"
  }
}

trajectory is the sequence about to run — one call or several. The response carries the governing rule, the Ω domain, a replayable trajectory_hash, and an attestation tying the verdict to the exact engine commit and ruleset.

Authorization contract

The same six steps
in every deployment profile.

01
Identity

The calling identity and the authority it actually holds are resolved first.

02
Policy

The envelope and Ω definitions in force are loaded and verified by signature.

03
Verdict

The proposed trajectory is evaluated deterministically. Permit, escalate or block.

04
Approval

Where escalation applies, an independent approver decides. Nothing executes while held.

05
Execution

Only an authorized transition is issued to the downstream system.

06
Evidence

The proposal, policy state, verdict, approval and result are recorded and hash-linked.

Verdict handling

Three branches.
One of them issues the call.

PermitIssue the call. No configured forbidden state is reachable from it.
EscalateHold. The response names the required authority and action.
BlockDo not issue. The trajectory reaches Ω.
TypeScript — gate a dispatchts
import { guardedDispatch, GovernanceBlocked } from "./governanceGuard";

// The boundary sits at plan -> act. Nothing above it changes.
try {
  await guardedDispatch(
    { tool: "transfer_funds", args: { amount: 50000, to: "acct_991" } },
    (call) => runTool(call),        // PERMIT   -> issue the call
    (v) => routeToApprover(v.review), // ESCALATE -> independent approval
    { domains: ["finance"] },
  );
} catch (e) {
  if (e instanceof GovernanceBlocked) deny(e.result.reason); // BLOCK -> never issued
}
Python — gate before executionpy
from governance_guard import guard, GovernanceBlocked, GovernanceEscalation

try:
    guard("transfer_funds", {"amount": 50000, "to": "acct_991"},
          domains=["finance"])
    run_tool(...)                 # PERMIT   -> issue the call
except GovernanceEscalation as e:
    route_to_approver(e.review)   # ESCALATE -> independent approval
except GovernanceBlocked as e:
    deny(str(e))                  # BLOCK    -> never issued

On ESCALATE the response carries a review record you can render or forward to an approver:

Response — ESCALATEjson
{
  "verdict": "ESCALATE",
  "permitted": false,           // held — not issued
  "requires_human_review": true,
  "omega_domain": "healthcare",
  "review": {
    "reason": "Clinical recommendation generated.",
    "required_action": "Oncology consultant review.",
    "decision_authority": "Oncology consultant",
    "execution_status": "HELD FOR HUMAN REVIEW"
  }
}
Fail-closed behaviour

The absence of an authorization
is not an authorization.

An unreachable evaluator, an unverifiable policy bundle, a tampered signature or a timeout all resolve the same way: the transition is not authorized, so the call is not issued.

Fail-closed — the default pathpy
# Fail-closed is the default and is not configurable away.
# An unreachable evaluator, an unverifiable policy bundle or a
# timeout all resolve to "not authorized" — never to "proceed".

except GovernanceUnavailable:
    deny("authorization unavailable")   # the call is not issued
Adapter patterns

The adapter changes.
The contract does not.

OpenAI AgentsGate the tool-dispatch step.
LangGraphA governance node placed before the tool node.
LangChainA pre-tool guard wrapping each tool once.
AutoGenGate the execute step of the agent loop.
MCPAt the client or host, before a call is forwarded.
Custom orchestratorOne call at the plan → act boundary.
Evidence output

Every verdict is replayable.

trajectory_hashIdentifies the evaluated sequence. The same trajectory against the same policy state reproduces the same verdict.
attestationTies the verdict to the engine commit and ruleset hash that produced it.
Chain linkageEach record hashes the one before it, so an alteration anywhere breaks verification.
Metadata-only loggingTool arguments and payloads are not stored — the evaluation record holds metadata and the decision.
Evidence & methodologyEvidence chain
Deployment profiles

Where enforcement runs
is your decision.

HostedCall the managed endpoint. Fastest path to a first verdict.
Self-hostedRun the engine in your own VPC, pinned to a commit. No egress.
On-premisesEnforcement and evidence inside your estate.
Air-gappedSigned local policy bundles. No required external control plane or network.
Guardian OSSovereignSecurity & deployment

One call, before the call.

Copy the guard, point it at an endpoint, and run a trajectory through it.

Developer quickstart →Test a trajectory →Ω exposure — upload a manifest