Agent governance

AI Agent Governance

When an autonomous agent can call tools, spend budget, and chain actions, the risk is not the model output — it is the side effect. EVE governs the moment before a tool executes: it can block or require approval before a tool runs, block individually-permitted actions that combine into a prohibited sequence, and enforce deterministic budget limits.

Controls for agent behavior

Tool-call governance — route each agent tool call through a deterministic ALLOW / BLOCK / MODIFY decision before execution.
Action-sequence governance — actions that are each permitted alone can still be blocked when they form a prohibited sequence.
Budget and resource limits — a permitted call executes until the configured limit is reached, then further calls are blocked.
Behavioral anomaly detection — deterministic statistical detectors (rolling/robust z-score, EWMA, CUSUM) flag deviations from a window baseline.
Signed monitoring envelopes — summarize agent behavior over a window, signed for later review.

SDK example

Route an agent's tool call through governance (Python):

from eve_coreguard import CoreGuardClient

client = CoreGuardClient(api_key="eve_sk_...")

def governed_call(tool, arguments):
    result = client.evaluate(
        request_id="sess_1",
        tenant_id="org_abc",
        proposed_action={"type": "tool_call", "tool": tool, "arguments": arguments},
        model_output={"decision": "proceed"},
        context={"principal_id": "agent_alpha", "session_id": "sess_1"},
        policy_set="agent_tools_v1",
    )
    if result.decision.status == "BLOCKED":
        raise PermissionError(result.decision.action)
    return run_underlying_tool(tool, arguments)  # only reached on ALLOWED/MODIFIED

TypeScript (ESM, Node >= 18) — there is no TypeScript enforcement client; enforce from Node via the REST API:

// eve-ai-governance (npm 0.3.1) is an offline verification library; enforce via REST.
const res = await fetch("https://api.eveaicore.com/v1/decisions/evaluate", {
  method: "POST",
  headers: { Authorization: "Bearer eve_sk_...", "Content-Type": "application/json" },
  body: JSON.stringify({
    request_id: "sess_1", tenant_id: "org_abc",
    proposed_action: { type: "tool_call", tool, arguments },
    model_output: { decision: "proceed" },
    context: { principal_id: "agent_alpha", session_id: "sess_1" },
    policy_set: "agent_tools_v1",
  }),
});
const { decision } = await res.json();
if (decision.status === "BLOCKED") throw new Error(decision.action);

Readiness

Agent governance controls (sequence, budget, anomaly detection, monitoring envelopes) are PILOT_READY and part of the pilot-validated core governance architecture. The Python SDK entry point (from eve_coreguard import CoreGuardClient) is a release-candidate core client. Framework adapters other than the generic adapter are experimental.

Limitations

Behavioral anomaly detectors are advisory unless wired to a deterministic enforcement action.
Sequence state is per-session and in-process in the pilot; durable multi-instance state is a deployment concern, and durable cross-instance budgets require a shared store.
Wrapper-enforced framework adapters can be bypassed by a direct call to the underlying tool. Hard enforcement requires a gateway or sidecar; cooperative hooks are not an unbypassable boundary.

Agent Authority Gateway (proof-bound execution)

A fail-closed authorization layer that binds an agent's intent to EVE's authority: a governed action is authorized only against a deterministic (no-LLM) policy, the agent's verified identity, its delegated authority, and the exact parameters — after which EVE can issue a short-lived, single-use, parameter-bound authorization certificate that a downstream connector must verify and atomically consume before executing.

Deterministic, replayable decisions — no LLM in the authorization path; every verdict has a stable digest.
Independently verifiable certificates — ECDSA P-384-signed, offline-verifiable against the published public key. A dependency-light verifier exists in Python and JavaScript and both agree on a frozen conformance corpus, so a third party can verify an EVE authorization certificate without calling EVE.
Governed-agent System-of-Record — durable, tenant-isolated agent identities (deny-by-default lifecycle; ECDSA P-384 proof-of-possession) and delegation edges that resolve an agent's effective authority by strict intersection. Managed from an owner console.

Status

Available and opt-in; off by default. The read-only/verification surfaces and the owner management consoles are deployed. Enforcement in the live decision path is a staged, reversible rollout — off → shadow (log-only, decisions unchanged) → per-tenant enforce with an instant kill-switch — and is not enabled by default: it changes no decision until an operator populates a tenant's agents/authority, completes a shadow burn-in, and explicitly enables enforcement for that one tenant. Enforcement never loosens a governance denial; it can only tighten.

Next step

Bring your own agent and policies into a pilot and see which tool calls, sequences, and budgets get blocked — with signed evidence for each decision.