agent-governance-toolkit

Why we included this project

Tool-calling agents that act autonomously create a different kind of risk than a plain chat interface, and this toolkit exists for teams that have to answer for what their agents actually do. Every tool call passes through a deterministic policy check before it reaches the wire, so a denied operation cannot happen even in principle, not just because the model was told not to. On top of that, it layers zero-trust identity, execution sandboxing, and tamper-evident audit logging, giving you a concrete answer when a security reviewer asks who did what and why. The controls map to all ten items of the OWASP Agentic Top 10, with compliance and threat-model documentation spelled out, which matters for regulated or security-conscious environments. Python teams can install it from PyPI, and the two-line wrapper keeps integration cheap enough to try against a real production workflow.