Quickstart

Governed in 5 minutes

4 steps. No API keys. No external services. Works with your existing agent framework.

Install → 30sCreate → 1mRegister → 1mEnforce → 2m

Install

30 seconds

npm install governance-sdk
# or
yarn add governance-sdk
# or
pnpm add governance-sdk

Zero runtime dependencies. TypeScript types included. Works in Node.js, Bun, edge runtimes.

Create a governance instance

1 minute

import { createGovernance } from "governance-sdk";

const gov = createGovernance({
  rules: [
    {
      id: "block-risky-tools",
      condition: {
        type: "tool_blocked",
        params: { tools: ["shell_exec", "db_drop", "bulk_export"] },
      },
      outcome: "block",
      reason: "High-risk tools require human approval",
      priority: 100,
    },
  ],
});

No storage config needed for development — defaults to in-memory with zero setup.

Register your agent

1 minute

const agent = await gov.register({
  name: "my-agent",
  framework: "mastra",   // mastra | vercel-ai | langchain | openai
  tools: ["search_web", "email_draft", "crm_update"],
  hasAuth: true,
  hasGuardrails: true,
  hasAuditLog: true,
});

console.log(agent.score);     // 68
console.log(agent.level);     // 3
console.log(agent.status);    // "active"

Score is computed from 7 governance dimensions. Run gov.register() once at agent startup.

Enforce before every tool call

2 minutes

// Wrap your tool execution:
async function callTool(agentId: string, tool: string, params: unknown) {
  const result = await gov.enforce(agentId, { tool, params });

  if (result.outcome === "block") {
    throw new Error(`[${result.rule}] ${result.reason}`);
  }

  // ✓ Allowed — proceed with execution
  return yourToolImplementation(tool, params);
}

// Example usage:
await callTool(agent.id, "email_draft", { to: "[email protected]" }); // ✓
await callTool(agent.id, "shell_exec", { cmd: "rm -rf /" });    // ✗ blocked

enforce() runs in-process and writes to the audit trail automatically.

✓

You're governed.

Every tool call is now policy-evaluated before execution, written to a tamper-evident audit trail, and contributing to your agent's governance score.

Next: go deeper

Add injection detection

Scan all user inputs for 64+ prompt injection patterns before your agent sees them.

→ detectInjection()

Set up PostgreSQL storage

Persist audit logs and agent registrations to Postgres with one line of config.

→ Storage docs

Add EU AI Act compliance

Map your governance config to 6 EU AI Act articles. August 2 deadline.

→ Compliance checker

Connect your framework adapter

Wrap every tool in Mastra, Vercel AI SDK, LangChain, or OpenAI Agents SDK.

→ Adapter docs