Demos

Demo: deterministic budget / resource-limit enforcement

Example status: illustrative, not runnable as written. The Python examples on this page are built on an embedded in-repo facade imported as core.eve_sdk (an EVE(...) object with govern_* methods). That module is not present in the current repository and is not published on any registry, so these snippets raise ModuleNotFoundError if run. They are kept because they show the intended governance flow. For code that runs today, use the published client: pip install eve-coreguard, then from eve_coreguard import CoreGuardClient and call client.evaluate(...), with offline evidence checking via client.verify_evidence(...) or the standalone verify_decision_record. See the CoreGuard integration guide and the Python SDK reference.

EVE enforces deterministic budget/resource limits: a permitted call executes until the configured limit is reached, then further calls are blocked. This demo sets a call budget of 3, runs 5 attempts, and shows the tool executing exactly 3 times.

Synthetic recording tool. No production credentials.

Readiness

Deterministic budget/resource controls: PILOT_READY (part of the pilot-validated agent governance surface).
Python only (embedded(service) mode).

Setup

# demo_budget_enforcement.py — synthetic fixtures only
from core.eve_sdk import EVE

IDENT = {"tenant_id": "acme", "principal_id": "agent-1", "session_id": "sess-1"}
searches = []  # recording target

def web_search(**kwargs):
    searches.append(kwargs)
    return {"results": []}

# Budget: at most 3 governed calls of this tool per session.
eve = EVE(policy="lending_v1", mode="embedded",
          budgets={"web_search": {"max_calls": 3}})

Code

verdicts = []
for i in range(5):
    r = eve.govern_tool_call(
        tool="web_search",
        arguments={"q": f"query-{i}"},
        context=IDENT,
    )
    verdicts.append(r.action)
    if r.allowed:
        web_search(q=f"query-{i}")

print("verdicts:", verdicts)
print("executions:", len(searches))
assert len(searches) == 3, "tool must execute exactly up to the budget"
assert verdicts[:3] == ["ALLOW", "ALLOW", "ALLOW"]
assert all(v == "BLOCK" for v in verdicts[3:]), "over-budget calls must be blocked"

Expected decision

Attempt	Verdict	Tool executed
1	ALLOW	yes
2	ALLOW	yes
3	ALLOW	yes
4	BLOCK (budget exceeded)	no
5	BLOCK (budget exceeded)	no

Expected evidence

Over-budget decisions carry a budget finding:

{"action": "BLOCK",
 "budget_finding": {"limit": 3, "consumed": 3, "exceeded": true},
 "reason_codes": ["...budget_exceeded..."],
 "certificate": {"signature": "kms-ecdsa-p384-...", "canon": "jcs-1"}}

Verification command

from core.eve_sdk import verify_evidence
last = eve.govern_tool_call(tool="web_search", arguments={"q": "extra"}, context=IDENT)
assert not last.allowed
assert verify_evidence("decision", last.certificate, expected_tenant="acme")["valid"]
print("verify: True")

Zero-side-effect assertion

len(searches) == 3 after 5 attempts: the tool ran exactly to the configured budget and never once beyond it. Over-budget attempts left the recording list unchanged.

Cleanup

searches.clear()

No external state created.

Limitations

Budget counters are deterministic; durable cross-instance budgets require a shared store. In the pilot, budget state is in-process.
PILOT_READY, not production. Enforcement depends on your code honoring the verdict (or a gateway/sidecar).