Wrap the SDK ``Runner`` class to intercept ``run()`` calls. .. deprecated:: Use :meth:`as_hooks` instead. The ``wrap_runner()``

AddBackend registers an external policy backend consulted when no native rule matches.

InjectHeaders renders placeholders in an HTTP header map.

WithPolicyRules sets initial policy rules.

Attach a handler that captures formatted JSON strings.

Emit an audit event.

Handle a policy decision, including ESCALATE and DEFER. Args: decision: The PolicyDecision to enforce action: Name of

Return a context-manager urlopen stub yielding ``payload`` bytes.

Build a GET request with optional trust headers.

Get nested value from dict using dot notation.

Get API request headers.

Send a JSON response.

Log a trust event. Args: event_type: Type of event details: Event details trust_score: Associated trust s

Create a mock AutoGen agent.

Create a PluginManifest with sensible defaults.

Helper to construct a PKCS11KeyStore with mocked import.

Build an in-memory zip archive from a dict of filename → bytes.

Create a mock llamafirewall module.

Normalize a file path.

Parse a PEP 508 dependency specifier like ``plugin-name>=1.0.0``. Returns a ``(name, version_or_none)`` tuple. ``version`` is the pinned stri

Evaluate the AGT output intervention point and apply transforms. Returns the (possibly rewritten) result so callers see

Append an audit event to the internal audit log. Records the event only when log_all_calls is enabled. Args: event_type:

Create a connected Alice ↔ Bob secure channel pair.

Raise if command is not on the allowlist and policy is enforced.

Write *content* to a file under *tmp_path* and return its path.

Return a mock-released key, simulating SKR latency and errors.

Add a constraint to the agent.

Add documents to vector store. Args: documents: List of documents with embeddings Returns:

Record a sponsorship relationship.

Add an observation and update aggregate confidence.

Add a package to the SBOM and return it.

Create and append an :class:`EgressRule`.

Add or update a user preference. Args: user_id: User identifier preference_key: Type of preference (

ADK after_agent_callback — called after agent finishes. Checks agent output for blocked content and routes through the AGT 5

Create a native AutoGen intervention handler. This is the **recommended** integration path. The returned handler intercepts all mess

Create a binding between an AGT agent and an Entra identity. This is typically called once at agent registration/provisioning time. T

Build normalized skill-audit fields for adapter audit payloads.

Calculate a simple TTL-based decay factor. Returns 1.0 when the document is brand-new and linearly decays to 0.0 at ``_DEFAULT_TTL_DAYS

Check whether an outbound connection is permitted.

Check compliance with a regulatory framework. Args: framework: Framework to check against context: S

Check governance parity across all registered surfaces. Returns a report with gaps, parity score, and recommendations.

Record a comparison between current and candidate agent outputs. Uses the custom similarity function if set, otherwise falls back to

Fraction of measurements meeting the target within the window.

computeHash returns the SHA-256 hash of a length-prefixed encoding of the entry's fields. Each variable-length field is encoded as a 4-byte big-endian

Create a child intent that narrows the parent's scope. Child intents are used in multi-agent orchestration where the orchestrator dec

Create a constraint engine with sensible defaults. Args: max_cost: Maximum cost per action in dollars allowed_domains: L

* Delegate to a child agent with narrowed capabilities. * Child capabilities MUST be a subset of the parent's.

Return a denial for a policy evaluation error or fail-closed decision.

Detect sensitive data in the request payload. Uses Luhn algorithm to validate credit card numbers. Returns a list of detected

Enable OpenTelemetry instrumentation for AGT. Call once at application startup. If OTel SDK is not installed, this is a no-op with a warning.

End a span. Args: trace_id: Trace ID span_id: Span ID tags: Additional tags to add

Evaluate policies against *context* with async + thread safety. Submits the evaluation to the default executor and acquires the read

Evaluate *rules* against *context*, returning a decision. Rules are sorted by priority descending. The first rule whose **all** condi

Scan a directory for plugin manifests and evaluate each against a policy. Each immediate subdirectory containing an ``agent-plugin.yaml`` is trea

Enrich a policy evaluation context with wire-protocol facets. Uses the supplied registry or default_registry if none is given. Modifies conte

Format data as table, json, or yaml.

* Generate a complete HTML report. * * @param data - All report data inputs. * @returns Self-contained HTML string.

Generate a postmortem document from incident data. Assembles summary, impact, root cause analysis, detection details, response action

Query log entries with optional filters.

Return the execution context containing the full audit trail. Returns: The ``AssistantContext`` for this governed assistant, incl

Return all fields in a given category.

Get prompts filtered by category

Return the current trust score for *agent_id*.

Get all signal events, optionally filtered by signal type. Args: signal_type: Optional filter for signal type ("