Policy configuration for governed AI agents. Defines the complete set of constraints, thresholds, and audit settings that the governance laye

Evaluates a set of PolicyDocuments against execution contexts. Supports external policy backends (OPA/Rego, Cedar) alongside the native YAML/

Host-owned async orchestration around a stateless runtime client.

Agent Control Plane - Main interface for governed agent execution Layer 3: The Framework - The Governance Layer This is the pri

Governance kernel for LangChain agents and chains. Extends :class:`BaseIntegration` so that it inherits Cedar/OPA policy evaluation, ``pre_ex

Governance kernel for the OpenAI Agents SDK. Extends :class:`BaseIntegration` so that it inherits Cedar/OPA policy evaluation, ``pre_execute`

An alert to be sent to external systems.

A single condition evaluated against execution context.

A single governance rule within a policy document.

CrewAI adapter for Agent OS. Provides governance for CrewAI crews via two mechanisms: **Recommended (native hooks)**: Use :meth:`as_

Governance kernel for Google ADK. Extends BaseIntegration and provides callback functions that plug directly into ADK's before_tool_call

Vendor-neutral representation of a tool/function call.

Top-level declarative policy document.

Raised when a duck-typed adapter cannot safely wrap the requested shape.

A single planned action within an intent declaration. Attributes: action: The action name (e.g. "database_query", "file_write").

Governance policy for a RAG retriever. Args: allowed_collections: Explicit allow list of collection names. ``None`` means all

Configuration for a new Shared Session.

Ed25519 challenge/response trust handshake. Verifies: 1. Agent identity (Ed25519 signature over challenge nonce) 2. Registry members

An immutable episode representing a single agent experience. Episodes follow the pattern: Goal -> Action -> Result -> Reflection and

Default interceptor that enforces GovernancePolicy rules. Checks: - Human approval requirement (require_human_approval) - Tool is in

Measures the fraction of tasks completed successfully.

An immutable, structured event emitted by the hypervisor.

Configuration for a sandbox environment. Extends the minimal config with fields needed by session-based providers (``input_dir``, ``output_di

Tracks error budget consumption for an SLO. Error Budget = 1 - SLO target Burn Rate = actual error rate / allowed error rate Events are

Schema of a single MCP tool.

A single unit of work in an agent trace. Captures inputs, outputs, timing, and cost for one step (tool call, LLM inference, delegation, etc.)

Service Level Objective for an AI agent. Combines multiple SLIs with targets and an error budget to define what "reliable" means for this age

An event emitted by the AgentMesh system.

A single test prompt with expected behavior

Stateless kernel for MCP June 2026 compliance. Design principles: - Every request is self-contained - State stored in external backe

Complete trust score for an agent. Aggregates all dimension scores into a single 0-1000 score.

AutoGen adapter for Agent OS. Provides governance for AutoGen agents via two mechanisms: **Recommended (native intervention handler)**:

Governance kernel for HuggingFace smolagents. Extends BaseIntegration and intercepts tool calls on smolagents CodeAgent and ToolCallingA

Prometheus metrics for Agent OS kernel operations. Usage: metrics = KernelMetrics() # Record policy check

Capabilities advertised by an agent.

Complete context for a stateless execution request. All state needed for a request is passed here — the kernel never maintains session state

Privacy contract specifying data handling policies.

Describes an action from an IATP Capability Manifest.

Configuration for an agent instance. Attributes: agent_id: Unique identifier for this agent instance policies: List of policy nam

Append-only audit logging system. Entries are stored in a simple list with indexes for querying. An optional external :class:`~audit_bac

A single constitutional principle. Principles are natural language rules that outputs must comply with. They are evaluated by an LLM

Declarative policy engine. Features: - YAML/JSON policy definitions - <5ms evaluation latency - 100% deterministic across runs

Cost tracking, budgeting, and anomaly detection. Tracks per-task and per-agent costs, enforces budgets, detects anomalies, and can auto-throt

Input to an evaluation judge.

Restricted execution environment that frustrates stdlib bypass. Combines import hooks, ``sys.modules`` shadowing, restricted builtins, and AS

Network-aware trust engine with temporal decay and regime detection. Parameters ---------- decay_rate : float Per-hour decay

OpenAI Assistants adapter for Agent OS. Provides governance for: - Assistant creation/modification - Thread management - Run exe

A single reputation signal.

Main message bus interface for AI Agents. This class provides a simple API for publishing and subscribing to messages with support f

Public host wrapper over :class:`agent_control_specification.AgentControl`. Construct with the path to an AGT manifest. When ``resolution_root``

Context passed through the governance layer

Manages time-bounded ring elevations with policy enforcement. Elevation requests are evaluated against trust score thresholds. Ring 1 require

Agent card containing identity and trust information. Used for agent discovery and verification in multi-agent systems.

AgentMiddleware that evaluates declarative governance policies. Two construction paths are supported: 1. **Legacy v4** — pass an :class:`age

PydanticAI adapter for Agent OS. Supports: - Agent wrapping with governance (run / run_sync) - Individual tool call interception (al

A rules-based judge using heuristics instead of LLMs. Useful for testing the evaluation pipeline, baseline comparisons, and fast pre-scr

A single policy decision candidate awaiting conflict resolution.

Capability manifest exchanged during handshake. This is the core metadata that agents exchange.

A chaos engineering experiment against agent(s).

Signed proof of a governance decision for an MCP tool call.

Append-only structured event store with pub/sub. All hypervisor components emit events here. Supports: - Append-only storage (immutable

Controls which MCP servers plugins are allowed to use.

Errors related to the plugin marketplace.

Result of intercepting a tool call.

Registry for agent identities. In production, this would be backed by a database and the AgentMesh CA.

Lightweight tool registry using a local dictionary store. This registry stores tool specifications and their callables but does NOT execute t

AWS Bedrock Agent governance adapter. Wraps a ``boto3`` Bedrock Agent Runtime client and enforces governance on every ``invoke_agent`` call.

Security gateway that sits between MCP clients and servers. Enforces governance policies on all tool calls passing through, providing defense

Raised when a MAF agent invocation violates governance policy. Subclass of :class:`agent_os.exceptions.PolicyViolationError` so the canonical

A complete agent execution trace. Contains all spans from a single task execution, forming a tree of operations that can be replayed determin

FunctionMiddleware that enforces tool allow/deny lists. Two construction paths are supported: 1. **Legacy v4** — pass ``allowed_tools`` and/

Kill switch with agent process registry and handoff support. Agents register termination callbacks via ``register_agent``. When ``kill`

Top-level marketplace policy controlling plugin admission.

A single step in a progressive rollout.

Top-level orchestrator for the Agent Hypervisor. Usage (basic — sigma_raw passed directly): hv = Hypervisor() session = awai

Policy Engine - Enforces governance rules for agent execution Provides: - Rate limiting and quotas - Risk assessment - Access co

Audit sink that emits one JSON object per line (JSONL) to stdout. Designed for containerised deployments where log aggregation systems (Kuber

Hybrid circuit breaker supporting SRE and legacy agent-os callers.

Instruments A2A and MCP calls with correlated, protocol-aware spans. Provides context managers for tracing individual protocol calls and prod

Framework-agnostic HTTP trust verification. Parameters ---------- identity : AgentIdentity, optional Local agent identity used to

A version counter (Public Preview: tracking only, no enforcement). Thread-safe: all reads and mutations are guarded by an internal lock to pr

A governance audit log entry.

Single audit log entry. All fields are preserved for API compatibility. Hash fields are populated when entries are added via :class:

Errors related to agent identity (DID, keys, credentials).

Scans MCP tool definitions for poisoning, rug pulls, and protocol attacks. Usage:: scanner = MCPSecurityScanner() threats = scan

Screens agent inputs for prompt injection attacks (OWASP LLM01 / ASI01). Usage:: detector = PromptInjectionDetector() result = d

Manages revoked agent identities with optional file-backed persistence. Args: storage: "memory" for in-memory only, or a file path for fi

Manages alert channels and dispatches alerts. Usage: manager = AlertManager() manager.add_channel(ChannelConfig(

Orchestrates escalation, offensive intent, and loop detection to produce composite conversation alerts. Thread-safe: all state mutations are

Normalized result from an external policy backend. The optional ``proof_artefact`` and ``verification_pointers`` fields let high-assurance ba

Configuration for an alert channel.

Validates LLM-generated code for security issues using AST analysis. Checks cover dangerous imports, unsafe calls, shell injection, SQL injec

Manages credential lifecycle. Handles: - Credential issuance - Validation - Rotation - Revocation propagation

Immutable governance event envelope. Schema v1. Fields are additive-only across schema versions. Sinks must tolerate unknown fields by ignori