Return *token* with control chars stripped and length capped. Defends against log-injection by attacker-controlled package names that contain

Returns a finding (with optional line) if the rule fires, or null.

Register a tool in the registry. Args: spec: The tool specification callable_func: The actual callable function (stor

Execute an action statelessly with full policy governance. This is the main entry point. Every request is self-contained: po

Append a new audit entry and return it (with computed hash fields).

Scan a single MCP tool definition for threats. Args: tool_name: Name of the tool. description: Tool description (prim

Evaluate context and return action: 'allow', 'warn', or 'deny'.

Execute a plugin function in the sandbox. Args: plugin_name: Installed plugin name (directory under plugins_dir). ent

Register a plugin manifest. Args: manifest: The manifest to register. mcp_servers: Optional list of MCP server names

Cryptographically sign this card with the given identity. Args: identity: The identity to sign with (must have private key)

Get a card by agent DID.

Make a GET request. Args: url: URL to request (must be in allowed domains) headers: Optional request

Analyze a single message in an agent-to-agent conversation. Runs all three detectors and produces a composite alert. Args:

Start the proxy server.

Generate a valid registration request with proof-of-possession. Returns (body_dict, signing_key, derived_did).

Register a card after verifying its signature. Args: card: The card to register Returns: True if re

Initiate a simple nonce-based handshake with a peer. Args: require_freshness: If True, include an RFC 9334 freshness

Return all blocked patterns that match the given text.

Scan a single tool definition.

Create a test OrgPolicy.

Create and register native CrewAI governance hooks. This is the **recommended** integration path. The returned :class:`GovernanceHoo

Create a principal with mutable inputs.

Add a span to this trace.

Create an agent with standard permissions

Fetch the latest SLO snapshot.

Check if SVID is currently valid. Returns: True if the current time is within the issued/expiry window.

Simple linear decay for agents without recent positive signals. Call this periodically (e.g. every minute). Returns deltas.

Add governance to one or more AutoGen agents. .. deprecated:: Use :meth:`as_handler` instead. The monkey-patch approach

Log an audit event. The ``arguments_hash``, ``approver_did``, ``policy_version``, ``issued_at``, and ``completed_at`` parameters are

Event returns the latest event recorded for the kill switch.

GetTrustScore returns the current trust score for an agent.

Create a mock kernel suitable for most tests.

Return a :class:`GovernanceMiddleware` backed by this kernel. Pass the returned object to ``create_agent(middleware=[...])`` or to an

Release all resources (HTTP client + subprocess).

Wrap a LangChain chain, agent, or runnable with governance. .. deprecated:: Use :meth:`as_middleware` instead. The ``wrap()`` ap

Add an alert to the current batch.

Declare an execution intent. Args: agent_id: The declaring agent's identifier. planned_actions: Actions the agent int

Get a specific DLQ entry by message ID. Args: message_id: The message ID to look up Returns

Activate a session after handshaking is complete.

Function with invalid cost.

Produce a composite risk assessment for *agent_id*. Combines frequency z-score, entropy anomaly score, and capability violation score

Create a policy violation error from a structured check result.

Retrieve a single episode by ID.

Start the experiment.

Wrap a CrewAI crew with governance. .. deprecated:: Use :meth:`as_hooks` instead. The proxy-based approach mutates t

Create a LangChainKernel with the given policy overrides.

Wrap any callable with AGT governance — 2-line integration. Args: fn: The function, tool, or agent callable to govern. policy: Po

Register this agent on Nexus. Returns: RegistrationResult with status and initial trust score

Write a single audit entry to the sink.

Add a link to the chain with simple scope narrowing validation.

Check a file for policy violations.

Evaluate one intervention point. Translates the AGT snapshot to ACS shape, calls the engine, and maps the verdict back to :class:`Eva

* Log an audit entry

Register a tool with the MCP adapter.

Create a GovernancePolicy with sensible test defaults.

Generate a unique namespace to avoid prometheus_client global state collisions.

Capture a delta for a turn, chaining to previous entry.

Load an RBACManager from a YAML file.

Kill an agent, handing off in-flight steps to a substitute if available. Registration invariant: the agent is unregistered from the p

Request temporary ring elevation. Elevation is granted if the agent's trust score meets the threshold for the target ring. Ring 1 add

Create a mock OpenAI Agent.

Evaluate an A2A task request against policies. Content-pattern checks route through the AGT 5.0 ACS runtime via :class:`Adap

Run the crew - simulates CrewAI's kickoff()

Set a session attribute value. For monotonic attributes, the value can only move forward in the ordering. Attempts to move backward a

Start a new trace and set as current. Args: operation_name: Name of the root operation Retu

Subscribe to a topic with a message handler. Args: topic: Topic to subscribe to handler: Async funct