agent-governance on tomrochette.com

Code Atelier Governance SDK

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

The Code Atelier Governance SDK (code-atelier-governance) is an MIT-licensed Python SDK that wraps LLM clients and tool calls in pre-execution enforcement gates (scope, budget, approvals, loop detection, presence) and writes an HMAC-chained audit trail to the Postgres your application already runs.

Its thesis is that tracing tools explain what an agent did after the damage, so the useful primitive is a gate that fires before the LLM call and denies it, backed by an audit chain a regulator can verify without a new data platform.

What it is
#

pip install code-atelier-governance exposes a GovernanceSDK with eight modules: Audit, Scope, Cost, Gates, Loop Detection, Presence, Contracts, and Compliance. Scope is a per-agent allowlist with hidden tools removed from the LLM context and default deny; Cost enforces token and USD caps per session and per agent-day with built-in pricing for more than twenty models and a combined budget query; Gates issues single-use HMAC-bound approval tokens for high-risk actions. The audit trail is an append-only HMAC chain with optional Ed25519 per-row signatures, on-demand chain verification, and EU AI Act Article 12 evidence reports. Integrations are one-line wrappers for OpenAI, Anthropic, and LangChain, plus a sync wrapper for Flask and Django, and everything depends only on a Postgres connection string, with an optional read-only console. The vendor is Code Atelier, and the source lives at imleopereira/agentic-governance.

Status
#

Active but essentially unadopted. The SDK is at version 0.7.3 with 11 PyPI releases, and the repository was created 2026-04-09 with a last push on 2026-07-23 as of 2026-09-27. The repository has 0 stars, 0 forks, and no description or topics, which is unusual for a project with a polished documentation site and a hosted platform bridge. The community footprint is absent: a Hacker News search for Code Atelier governance returns nothing, so every claim here rests on the vendor’s own pages and the repository. What earns the note despite the silence is the threat model, which states plainly what the SDK does not protect against instead of implying it is a complete security boundary. The vendor also publishes a scaffolder that wires a Microsoft Agent Governance Toolkit agent through these gates, which is a rare, concrete interoperability gesture in this category.

Strengths
#

Just Postgres: no Redis, Kafka, ClickHouse, sidecar, or background worker, so adoption cost is close to zero for a team already on Postgres.
Fail-closed enforcement by default (cost, scope, and gates raise), while observation surfaces warn and continue, which is the right asymmetry.
A written threat model that names the bypasses (direct client calls, subprocesses, tool calls inside LLM responses) rather than hiding them.
EU AI Act Article 12 evidence export and a self-approval prevention design show the compliance audience is being taken seriously.

Cautions
#

0 stars and no third-party usage evidence; the only assessment available is the vendor’s own.
In-process gates do not defend against a second process or any code path that calls OpenAI or Anthropic directly, and the README says so; network-level enforcement needs a proxy.
Scope enforcement gates the LLM call, not the tool calls returned inside the response, so a determined agent can still execute a disallowed tool unless you enforce at the tool layer too.
Tampering is detected only when verification runs; a database administrator with key control can still replace the chain, as the threat model admits.
v0.6.2 flipped several defaults to fail-closed and broke callers, so read the upgrade notes before following an older tutorial.

Pricing
#

MIT licensed and free. A hosted platform exists through an opt-in bridge that dual-writes audit events while keeping local Postgres authoritative, plus a read-only console, but no prices are published.

Compared to
#

Veto: a framework-agnostic authorization kernel with a commercial cloud and portable receipts; choose Veto for TypeScript or polyglot stacks and this SDK when you are Python and Postgres and want budget and loop gates too.
Microsoft Agent Governance Toolkit: broad, vendor-backed, and multi-language with identity and sandboxing; choose AGT for a governance program, and this SDK for the smallest viable gate.
Langfuse: observability that records what happened; choose Langfuse to understand agent behavior, and this SDK to block a call before it happens.

Bottom line
#

Recommended for Python teams already on Postgres that want a minimal pre-execution gate with budgets, approvals, and a tamper-evident audit trail. Not for polyglot stacks, teams needing process or network-level enforcement, or anyone who requires an adopted project with independent security review.

Changes
#

2026-09-27 - Created.

References
#

https://www.codeatelier.tech/governance - overview: modules, comparison table, Article 12 framing
https://www.codeatelier.tech/governance/quickstart - quickstart: install, schema, gates, console, sync wrapper
https://github.com/imleopereira/agentic-governance - README: modules, threat model, configuration, standards
https://api.github.com/repos/imleopereira/agentic-governance - stars, forks, creation and push dates as of 2026-09-27
https://pypi.org/pypi/code-atelier-governance/json - version 0.7.3, MIT license, 11 releases
https://raw.githubusercontent.com/imleopereira/agentic-governance/production/CHANGELOG.md - release notes: fail-closed defaults and the AGT recipe scaffolder

Microsoft Agent Governance Toolkit

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

The Microsoft Agent Governance Toolkit (microsoft/agent-governance-toolkit) is an MIT-licensed, multi-language toolkit that intercepts each agent tool call, message send, and delegation in application code and evaluates it against policy before the action reaches the wire.

Its thesis is that prompt-level safety is a polite request to a stochastic system, so governance belongs in deterministic code outside the model, and this is the most complete shipping expression of that idea: policy, identity, sandboxing, SRE, and compliance in one repository.

What it is
#

pip install "agent-governance-toolkit[full]" installs a policy engine with YAML, OPA Rego, and Cedar support, plus a govern() wrapper that checks, logs, and enforces every tool call. The packages are Agent OS (policy), Agent Mesh (DID identity and trust scoring), Agent Runtime (execution rings and sandboxing), Agent SRE (SLOs, circuit breakers, kill switch), Agent Compliance (OWASP and EU AI Act mapping), Agent Marketplace, Agent Lightning, and Agent Hypervisor. SDKs exist for Python, TypeScript, .NET, Rust, and Go, with first-party plugins for Claude Code, Copilot CLI, Codex CLI, and OpenCode, and adapters for LangGraph, CrewAI, the OpenAI Agents SDK, Semantic Kernel, and Microsoft Agent Framework. It is published under the Microsoft organization, but the team states an intent to move it to a foundation, and the README calls it a public preview that may break before GA.

Status
#

Active, wide, and fast-moving: 6,349 stars, 1,131 forks, and 91 open issues as of 2026-09-27, created 2026-03-02, last pushed 2026-09-26, latest release v4.1.0 on 2026-06-09. The community footprint is thin relative to the star count: the Hacker News submissions I found top out at 6 points, and the most substantive third-party writeup is a security critique rather than a tutorial. That critique (April 26, 2026) found a caller-controlled X-Agent-ID header flowing into audit, policy, and rate-limit consumers with no verification, six exported security primitives with zero production callers, and an in-memory audit log that breaks its own integrity check on overflow. The project has since shipped several breaking refactors, but I could not confirm from primary sources that the specific wiring gaps are closed, so treat the critique as a pre-adoption checklist rather than a resolved incident.

Strengths
#

The only toolkit in this category that ships policy, identity, sandboxing, SRE, and compliance as one spec-backed product, with formal RFC 2119 specifications and hundreds of conformance tests.
Genuinely polyglot: five language SDKs and framework adapters, so governance does not dictate your stack.
Deterministic and fail-closed at the interception point, which is the correct place to enforce anything that must not happen.
Vendor-backed with the open-source fundamentals most tools here lack (CodeQL, continuous fuzzing, OpenSSF Scorecard, a published security policy).

Cautions
#

The April 2026 critique is the strongest published skeptical source in this whole category; confirm that identity is authenticated on your request path and that audit storage is durable before trusting the landing page.
Public preview with breaking changes between minor versions; pin deliberately and read BREAKING_CHANGES before upgrading.
Governance runs in application middleware, not at the OS kernel, and the README recommends one container per agent for real isolation.
Breadth is a cost: seven packages and ten specifications is a large surface to evaluate for a small team.

Pricing
#

MIT licensed and free, self-hosted, no paid tier. Deployment guides cover Azure, AWS, GCP, and Docker Compose.

Compared to
#

Veto: a narrower, single-purpose authorization kernel with a commercial cloud; choose Veto for one gate in front of risky tool calls, and this toolkit for a governance program across languages and frameworks.
SIDJUA: a self-hosted orchestrator with pre-action enforcement baked into the runtime; choose SIDJUA for a small always-on agent company, and this toolkit when the agents and frameworks already exist.
Code Atelier Governance SDK: a Python and Postgres-only enforcement SDK; choose it for a minimal footprint, and this toolkit for multi-language coverage and identity.

Bottom line
#

Recommended for platform teams standardizing deterministic agent governance across multiple languages and frameworks, who can independently verify the enforcement wiring. Not for single-agent projects or teams that want a thin, drop-in gate, since the surface is large and the preview churn is real.

Changes
#

2026-09-27 - Created.

References
#

https://github.com/microsoft/agent-governance-toolkit - README: packages, quickstart, specs, preview notice, security boundaries
https://api.github.com/repos/microsoft/agent-governance-toolkit - stars, forks, issues, push date as of 2026-09-27
https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/ - launch post: seven packages, OWASP mapping, foundation intent
https://www.flyingpenguin.com/authentication-bypass-in-microsoft-agent-governance-toolkit-at-573f989/ - critical security review of identity wiring and audit durability
https://api.github.com/repos/microsoft/agent-governance-toolkit/releases - v4.1.0, 2026-06-09
https://pypi.org/pypi/agent-governance-toolkit/json - distribution and version 4.1.0

SIDJUA

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

SIDJUA (GoetzKohlberg/sidjua) is an AGPL-3.0 governance-first orchestration platform that runs a five-stage pre-action pipeline (forbidden, approval, budget, classification, policy) outside the agent before any action executes.

Its thesis is that governance enforced by architecture beats governance enforced by prompting, and the pipeline order is the whole argument: if an action is forbidden it never reaches the model, and if it exceeds budget the task is cancelled rather than flagged.

What it is
#

Every action passes Forbidden, Approval, Budget, Classification, and Policy checks before the agent’s LLM call happens, and the README states that governance-critical operations have no log-and-review-later mode. The organization is defined in one divisions.yaml: agents live in divisions and tiers (tier 1 full autonomy, tier 2 approval for sensitive operations, tier 3 fully supervised), each with per-task and per-month budgets, and sidjua apply provisions agents, RBAC, routing, audit tables, and rules in ten steps. The runtime is a Node.js and SQLite service with a web management console on port 47821, always-on daemons with a four-eyes mutual watchdog, governed cron schedules, an append-only audit trail with SHA-256 integrity checks, bubblewrap sandboxing on Linux, and eight messaging channels. Providers include Anthropic, OpenAI, Google, Groq, Cloudflare Workers AI, Ollama, and any OpenAI-compatible endpoint, and it can import OpenClaw configuration. It is dual-licensed AGPL-3.0 plus a commercial license, with an enterprise tier for organizations running 100 or more agents.

Status
#

Dormant, with the stated restart date missed. The repository was created 2026-03-02 and sits at 26 stars, 2 forks, and 4 open issues as of 2026-09-27, with the last push on 2026-04-21 and the last release v1.1.1 on 2026-04-17. The website announces a development freeze and says public downloads are “scheduled to reopen in July 2026”, but it is now late September 2026 with no source activity for five months and the freeze notice still showing the same date. This is the category’s second stall record after TinyAGI, and the pattern is the same: a compelling governance pitch and a young codebase that ran out of maintainer momentum. The owner is a single GitHub user account, not an organization, and the site’s “we move fast” framing sits awkwardly next to five months of silence.

Strengths
#

The five-stage pre-action pipeline is a clean, explicit model of where each control belongs, and it is the clearest articulation of pre-action enforcement in this category.
Structural enforcement that the agent cannot detect or disable is the correct answer to prompt-based governance, and the architecture explains it well.
Self-hosted, air-gap capable, model-agnostic, and light enough to run on a Raspberry Pi with local models.
The audit trail uses an integrity-verified write-ahead log and a governed scheduler with fail-closed cost caps, which is more than most young tools attempt.

Cautions
#

Downloads are frozen, the reopen date has passed, and the source has been quiet since April 2026; adopt as a fork-first decision or a case study, not as a supported dependency.
Single maintainer, no organization, and no successor or handoff announced.
The most striking claims are self-reported: three AI auditor systems, fifteen audits, “most secure Node.js app I’ve audited in years”, and two filed patents. None of this is independently verifiable from the sources I found.
The site compares itself favorably to Paperclip and OpenClaw in marketing language, so read the comparison table as positioning rather than measurement.

Pricing
#

SIDJUA Free is AGPL-3.0 for self-hosting and personal use. A commercial license is required for hosting providers and SaaS operators, and an enterprise license covers 100 or more agents with SLA and compliance support. No dollar prices are published, so there is nothing to track yet.

Compared to
#

Paperclip: the living control plane with budgets, org charts, and a cloud path; choose Paperclip today, and read SIDJUA for the pre-action enforcement model.
Microsoft Agent Governance Toolkit: governance wired into existing frameworks in five languages; choose AGT when you already have agents, and SIDJUA when you want the orchestrator and the governance in one self-hosted platform.
Veto: a single authorization gate rather than a platform; choose Veto for a narrow, live tool-call control and SIDJUA as a case study of the broader pipeline.

Bottom line
#

Recommended as a case study of pre-action enforcement architecture, and as a fork candidate for a self-hosted governed agent company. Not for production adoption while downloads are frozen, the announced reopen date has passed, and there is no maintainer activity to depend on.

Changes
#

2026-09-27 - Created.

References
#

https://github.com/GoetzKohlberg/sidjua - README: five-stage pipeline, divisions and tiers, audit WAL, licensing, roadmap
https://api.github.com/repos/GoetzKohlberg/sidjua - stars, forks, issues, last push 2026-04-21 as of 2026-09-27
https://www.sidjua.com/ - homepage: development freeze notice, reopen-in-July claim, self-reported audits
https://sidjua.com/docs - the same freeze and release-status surface
https://api.github.com/repos/GoetzKohlberg/sidjua/releases - v1.1.1, 2026-04-17, the final release
https://api.github.com/users/GoetzKohlberg/repos - the maintainer’s single public repository

agent-governance on tomrochette.com

Code Atelier Governance SDK

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

Microsoft Agent Governance Toolkit

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

SIDJUA

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

agent-governance on tomrochette.com

Code Atelier Governance SDK

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

Microsoft Agent Governance Toolkit

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

SIDJUA

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#