policy-enforcement on tomrochette.com

Code Atelier Governance SDK

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

The Code Atelier Governance SDK (code-atelier-governance) is an MIT-licensed Python SDK that wraps LLM clients and tool calls in pre-execution enforcement gates (scope, budget, approvals, loop detection, presence) and writes an HMAC-chained audit trail to the Postgres your application already runs.

Its thesis is that tracing tools explain what an agent did after the damage, so the useful primitive is a gate that fires before the LLM call and denies it, backed by an audit chain a regulator can verify without a new data platform.

What it is
#

pip install code-atelier-governance exposes a GovernanceSDK with eight modules: Audit, Scope, Cost, Gates, Loop Detection, Presence, Contracts, and Compliance. Scope is a per-agent allowlist with hidden tools removed from the LLM context and default deny; Cost enforces token and USD caps per session and per agent-day with built-in pricing for more than twenty models and a combined budget query; Gates issues single-use HMAC-bound approval tokens for high-risk actions. The audit trail is an append-only HMAC chain with optional Ed25519 per-row signatures, on-demand chain verification, and EU AI Act Article 12 evidence reports. Integrations are one-line wrappers for OpenAI, Anthropic, and LangChain, plus a sync wrapper for Flask and Django, and everything depends only on a Postgres connection string, with an optional read-only console. The vendor is Code Atelier, and the source lives at imleopereira/agentic-governance.

Status
#

Active but essentially unadopted. The SDK is at version 0.7.3 with 11 PyPI releases, and the repository was created 2026-04-09 with a last push on 2026-07-23 as of 2026-09-27. The repository has 0 stars, 0 forks, and no description or topics, which is unusual for a project with a polished documentation site and a hosted platform bridge. The community footprint is absent: a Hacker News search for Code Atelier governance returns nothing, so every claim here rests on the vendor’s own pages and the repository. What earns the note despite the silence is the threat model, which states plainly what the SDK does not protect against instead of implying it is a complete security boundary. The vendor also publishes a scaffolder that wires a Microsoft Agent Governance Toolkit agent through these gates, which is a rare, concrete interoperability gesture in this category.

Strengths
#

Just Postgres: no Redis, Kafka, ClickHouse, sidecar, or background worker, so adoption cost is close to zero for a team already on Postgres.
Fail-closed enforcement by default (cost, scope, and gates raise), while observation surfaces warn and continue, which is the right asymmetry.
A written threat model that names the bypasses (direct client calls, subprocesses, tool calls inside LLM responses) rather than hiding them.
EU AI Act Article 12 evidence export and a self-approval prevention design show the compliance audience is being taken seriously.

Cautions
#

0 stars and no third-party usage evidence; the only assessment available is the vendor’s own.
In-process gates do not defend against a second process or any code path that calls OpenAI or Anthropic directly, and the README says so; network-level enforcement needs a proxy.
Scope enforcement gates the LLM call, not the tool calls returned inside the response, so a determined agent can still execute a disallowed tool unless you enforce at the tool layer too.
Tampering is detected only when verification runs; a database administrator with key control can still replace the chain, as the threat model admits.
v0.6.2 flipped several defaults to fail-closed and broke callers, so read the upgrade notes before following an older tutorial.

Pricing
#

MIT licensed and free. A hosted platform exists through an opt-in bridge that dual-writes audit events while keeping local Postgres authoritative, plus a read-only console, but no prices are published.

Compared to
#

Veto: a framework-agnostic authorization kernel with a commercial cloud and portable receipts; choose Veto for TypeScript or polyglot stacks and this SDK when you are Python and Postgres and want budget and loop gates too.
Microsoft Agent Governance Toolkit: broad, vendor-backed, and multi-language with identity and sandboxing; choose AGT for a governance program, and this SDK for the smallest viable gate.
Langfuse: observability that records what happened; choose Langfuse to understand agent behavior, and this SDK to block a call before it happens.

Bottom line
#

Recommended for Python teams already on Postgres that want a minimal pre-execution gate with budgets, approvals, and a tamper-evident audit trail. Not for polyglot stacks, teams needing process or network-level enforcement, or anyone who requires an adopted project with independent security review.

Changes
#

2026-09-27 - Created.

References
#

https://www.codeatelier.tech/governance - overview: modules, comparison table, Article 12 framing
https://www.codeatelier.tech/governance/quickstart - quickstart: install, schema, gates, console, sync wrapper
https://github.com/imleopereira/agentic-governance - README: modules, threat model, configuration, standards
https://api.github.com/repos/imleopereira/agentic-governance - stars, forks, creation and push dates as of 2026-09-27
https://pypi.org/pypi/code-atelier-governance/json - version 0.7.3, MIT license, 11 releases
https://raw.githubusercontent.com/imleopereira/agentic-governance/production/CHANGELOG.md - release notes: fail-closed defaults and the AGT recipe scaffolder

Microsoft Agent Governance Toolkit

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

The Microsoft Agent Governance Toolkit (microsoft/agent-governance-toolkit) is an MIT-licensed, multi-language toolkit that intercepts each agent tool call, message send, and delegation in application code and evaluates it against policy before the action reaches the wire.

Its thesis is that prompt-level safety is a polite request to a stochastic system, so governance belongs in deterministic code outside the model, and this is the most complete shipping expression of that idea: policy, identity, sandboxing, SRE, and compliance in one repository.

What it is
#

pip install "agent-governance-toolkit[full]" installs a policy engine with YAML, OPA Rego, and Cedar support, plus a govern() wrapper that checks, logs, and enforces every tool call. The packages are Agent OS (policy), Agent Mesh (DID identity and trust scoring), Agent Runtime (execution rings and sandboxing), Agent SRE (SLOs, circuit breakers, kill switch), Agent Compliance (OWASP and EU AI Act mapping), Agent Marketplace, Agent Lightning, and Agent Hypervisor. SDKs exist for Python, TypeScript, .NET, Rust, and Go, with first-party plugins for Claude Code, Copilot CLI, Codex CLI, and OpenCode, and adapters for LangGraph, CrewAI, the OpenAI Agents SDK, Semantic Kernel, and Microsoft Agent Framework. It is published under the Microsoft organization, but the team states an intent to move it to a foundation, and the README calls it a public preview that may break before GA.

Status
#

Active, wide, and fast-moving: 6,349 stars, 1,131 forks, and 91 open issues as of 2026-09-27, created 2026-03-02, last pushed 2026-09-26, latest release v4.1.0 on 2026-06-09. The community footprint is thin relative to the star count: the Hacker News submissions I found top out at 6 points, and the most substantive third-party writeup is a security critique rather than a tutorial. That critique (April 26, 2026) found a caller-controlled X-Agent-ID header flowing into audit, policy, and rate-limit consumers with no verification, six exported security primitives with zero production callers, and an in-memory audit log that breaks its own integrity check on overflow. The project has since shipped several breaking refactors, but I could not confirm from primary sources that the specific wiring gaps are closed, so treat the critique as a pre-adoption checklist rather than a resolved incident.

Strengths
#

The only toolkit in this category that ships policy, identity, sandboxing, SRE, and compliance as one spec-backed product, with formal RFC 2119 specifications and hundreds of conformance tests.
Genuinely polyglot: five language SDKs and framework adapters, so governance does not dictate your stack.
Deterministic and fail-closed at the interception point, which is the correct place to enforce anything that must not happen.
Vendor-backed with the open-source fundamentals most tools here lack (CodeQL, continuous fuzzing, OpenSSF Scorecard, a published security policy).

Cautions
#

The April 2026 critique is the strongest published skeptical source in this whole category; confirm that identity is authenticated on your request path and that audit storage is durable before trusting the landing page.
Public preview with breaking changes between minor versions; pin deliberately and read BREAKING_CHANGES before upgrading.
Governance runs in application middleware, not at the OS kernel, and the README recommends one container per agent for real isolation.
Breadth is a cost: seven packages and ten specifications is a large surface to evaluate for a small team.

Pricing
#

MIT licensed and free, self-hosted, no paid tier. Deployment guides cover Azure, AWS, GCP, and Docker Compose.

Compared to
#

Veto: a narrower, single-purpose authorization kernel with a commercial cloud; choose Veto for one gate in front of risky tool calls, and this toolkit for a governance program across languages and frameworks.
SIDJUA: a self-hosted orchestrator with pre-action enforcement baked into the runtime; choose SIDJUA for a small always-on agent company, and this toolkit when the agents and frameworks already exist.
Code Atelier Governance SDK: a Python and Postgres-only enforcement SDK; choose it for a minimal footprint, and this toolkit for multi-language coverage and identity.

Bottom line
#

Recommended for platform teams standardizing deterministic agent governance across multiple languages and frameworks, who can independently verify the enforcement wiring. Not for single-agent projects or teams that want a thin, drop-in gate, since the surface is large and the preview churn is real.

Changes
#

2026-09-27 - Created.

References
#

https://github.com/microsoft/agent-governance-toolkit - README: packages, quickstart, specs, preview notice, security boundaries
https://api.github.com/repos/microsoft/agent-governance-toolkit - stars, forks, issues, push date as of 2026-09-27
https://opensource.microsoft.com/blog/2026/04/02/introducing-the-agent-governance-toolkit-open-source-runtime-security-for-ai-agents/ - launch post: seven packages, OWASP mapping, foundation intent
https://www.flyingpenguin.com/authentication-bypass-in-microsoft-agent-governance-toolkit-at-573f989/ - critical security review of identity wiring and audit durability
https://api.github.com/repos/microsoft/agent-governance-toolkit/releases - v4.1.0, 2026-06-09
https://pypi.org/pypi/agent-governance-toolkit/json - distribution and version 4.1.0

SettleBridge

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

SettleBridge (a2a-settlement/settlebridge-ai) is a trust and policy gateway that sits between an agent and the A2A Settlement Exchange, enforcing reputation thresholds, spending caps, and provenance requirements before any agent-to-agent settlement proceeds.

Its thesis is that an agent economy needs a settlement layer above payments and authorization, so SettleBridge gates whether an economic obligation may be committed and records a Merkle-linked audit trail of the decision.

What it is
#

The gateway is a Python and FastAPI service with a React dashboard, a hot-reloading policy engine, a Redis-backed reputation cache, health monitoring of the upstream exchange and mediator, threshold-based alert rules, and a structured audit log. It deploys via Docker Compose, a Helm chart, or an AWS CloudFormation script, and the product page advertises 16 management API endpoints. An optional bounty marketplace (MARKETPLACE_ENABLED=true) adds escrow-backed contracts, a claim and submission flow, and an AI-assisted bounty drafting assistant. It is built on the open A2A-SE (A2A Settlement Extension) standard, which the same organization publishes under MIT, and the gateway sits on top of the upstream exchange, mediator, and auth projects rather than replacing them. The vendor is Truthsetter LLC.

Status
#

Early and low-traffic but actively maintained. The gateway repository was created 2026-03-08 and sits at 1 star, 0 forks, and 1 open issue as of 2026-09-27, with 76 commits and a last push on 2026-09-25; the A2A-SE standard repository has 2 stars. The website, pricing page, marketplace, and documentation are live and detailed, so this is a product with a real surface rather than an abandoned experiment. The community footprint is effectively absent: a Hacker News search for SettleBridge returns nothing, and the whole organization is in the low single digits of stars. One comparison worth naming: this is a young, standards-first effort where the software is secondary to the spec, so its survival depends more on A2A-SE adoption than on the gateway’s own traction.

Strengths
#

The only tool I found in this category whose subject is settlement (escrow, release, refund, dispute, finality) rather than tool-call authorization, which is a genuinely distinct and underserved layer.
Cryptographic audit design: Merkle tree integrity, append-only entries, and CSV or JSON export aimed at SEC 17a-4, SOX, and NIST examination.
Open-core with three real deployment paths and a published benchmark of time-to-first-interaction, so the quickstart is credible.
Standards-anchored: the A2A-SE specification is archived on Zenodo and positions itself against AP2 and x402 explicitly.

Cautions
#

License metadata is inconsistent and I could not resolve it: the website and pricing page call Community Apache-2.0, the GitHub README badge says MIT, the GitHub API reports no detected license, and the LICENSE path on main returns 404. Confirm the actual terms before shipping.
The public repositories are essentially unadopted (1 star), so no independent security review or third-party usage evidence exists yet.
The exchange charges a 0.25% treasury fee per settled transaction on top of any enterprise gateway cost, which is a real cost-of-goods line item for high volume.
The claimed compliance mappings (SEC 17a-4, SOX) are vendor assertions, not audited certifications.

Pricing
#

Community is free forever with the full gateway, policy engine, audit logging, and rate-limited exchange access. Enterprise is $2,500 per month per gateway with 24/7 support, SLAs, security patches within 24 hours, and custom policies. The Exchange charges 0.25% of each settled transaction as an ATE treasury fee.

Price history
#

Date	Plan	Change	Source
2026-09-27	Community	Introduced at $0, full gateway, rate-limited exchange access	https://settlebridge.ai/pricing
2026-09-27	Enterprise	Introduced at $2,500/month per gateway	https://settlebridge.ai/pricing
2026-09-27	Exchange	Introduced at 0.25% ATE treasury fee per settled transaction	https://settlebridge.ai/pricing

Compared to
#

Veto: pre-execution authorization for a single agent’s tool call; choose Veto to stop a refund or export, and SettleBridge when two independent agents must commit and settle value.
Microsoft Agent Governance Toolkit: in-process policy, identity, and audit across frameworks; choose AGT for governance of your own agents, and SettleBridge for trust across organizational boundaries.
SIDJUA: a self-hosted company of governed agents with budgets; choose SIDJUA for internal agent operations, and SettleBridge for commerce between agents you do not control.

Bottom line
#

Recommended for teams building agent-to-agent commerce that need escrow, reputation, and a cryptographic audit trail above the A2A protocol. Not for single-agent work or internal tool governance, and not until the license terms are confirmed from the repository itself.

Changes
#

2026-09-27 - Created.

References
#

https://settlebridge.ai/ - product framing, gateway components, open-core claim
https://settlebridge.ai/pricing - Community, Enterprise, and Exchange pricing with dollar and percentage amounts
https://github.com/a2a-settlement/settlebridge-ai - README: architecture, configuration, bounty marketplace, license statement
https://api.github.com/repos/a2a-settlement/settlebridge-ai - stars, forks, issues, push dates, and the null license field as of 2026-09-27
https://docs.a2a-settlement.org/docs/agent-settlement/ - A2A-SE: settlement lifecycle, three-layer model, interoperability
https://api.github.com/repos/a2a-settlement/a2a-settlement - the MIT-licensed standard repository behind the gateway
https://raw.githubusercontent.com/Agent-Analytics/awesome-multi-agent-orchestrators/main/README.md - the curated directory that flags the license metadata as inconsistent

Veto

tom@tomrochette.com (Tom Rochette) — Sun, 27 Sep 2026 00:00:00 +0000

Veto (PlawIO/veto) is an Apache-2.0 authorization layer that wraps an agent’s tools and returns allow, deny, warn, or require-approval verdicts from deterministic YAML rules before the tool handler runs, with a commercial Veto Cloud for shared approvals and records.

Its thesis is that authentication says who the agent is and sandboxing says where it runs, but neither answers whether this specific action should execute, so Veto inserts the missing authorization gate between intent and side effect and records a tamper-evident receipt for each decision.

What it is
#

protect(tools) in TypeScript or pip install veto in Python wraps a tool set; Veto loads ./veto/veto.config.yaml and ./veto/rules/*.yaml if present and otherwise applies observe-mode safe defaults so suspicious shell, file, database, and money patterns are logged rather than silently blocked. Rules support actions block, allow, warn, log, and require_approval, and the README publishes a runtime adapter matrix covering the Vercel AI SDK, OpenAI Agents, LangChain and LangGraph, MCP, Browser Use, OpenClaw, Claude SDK, Google ADK, Mastra, AutoGen, and CrewAI. Policy can be authored in plain English and compiled to reviewed YAML, but the LLM drafting step is explicitly outside the authority path; decisions are deterministic. Everything runs local-first, including a self-hostable evaluation server and an offline-verifiable veto.receipt/1 chain, and BYOC deployments keep policy and decision rows in the customer plane. It is made by Plaw, Inc. (US), which lists Veto as an EU AI Pact signatory.

Status
#

Active product, thin open-source community. The repository was created 2026-01-02 and sits at 14 stars, 2 forks, and 1 open issue as of 2026-09-27, last pushed 2026-06-18, with the latest published SDK release veto-sdk@2.9.3 on 2026-05-07. The website, docs, and pricing pages are current and extensive, and the company markets to agent vendors and regulated buyers, so the commercial product is clearly live. The public footprint is small: a Hacker News search for Veto returns nothing relevant, and the starred count is in the low tens, so adoption evidence comes from the product surfaces rather than the community. One operational wrinkle the README states plainly: Plaw does not yet control the unscoped veto npm name, so installs use the veto-cli package form until the transfer completes.

Strengths
#

Deterministic local evaluation by default, with no account, API key, or network needed for the core decision.
Approval is bound to the exact action hash and policy hash, so a mismatched approval fails closed rather than rubber-stamping a different call.
Offline-verifiable decision receipts and a published benchmark (p99 in microseconds for local single-rule and merged-pack evaluation) make the audit story concrete.
Broad framework coverage and two SDKs mean the gate is one wrapper call, not a rewrite.

Cautions
#

The open-source project is small (14 stars) and the last source push predates the latest docs, so treat the community as nascent and the company as the real support channel.
The free tier caps at 5,000 checks per month with a hard stop, and hosted pricing scales by checks, so a high-volume internal agent can move from free to several hundred dollars quickly.
The README notes the unscoped veto npm name is not yet controlled by Plaw, which is a supply-chain detail to watch.
Benchmarks are self-published and the comparison against another toolkit uses that toolkit’s own published numbers, not a reproduced head-to-head.

Pricing
#

Developer is $0 per month with 5,000 action checks, 7 days of decision records, and no credit card; the Apache-2.0 local engine is included. Hosted is $299 per month for 100,000 checks, $0.75 per 1,000 checks above plan, 90 days of records, and unlimited seats and reviewers. Enterprise is custom, covering cloud, BYOC, on-prem, or isolated networks with HIPAA BAA, SSO, SCIM, and SLAs.

Price history
#

Date	Plan	Change	Source
2026-09-27	Developer	Introduced at $0/month, 5,000 checks, hard cap	https://veto.so/pricing
2026-09-27	Hosted	Introduced at $299/month, 100K checks, $0.75 per 1K overage	https://veto.so/pricing

Compared to
#

Microsoft Agent Governance Toolkit: a broad multi-language governance program; choose AGT for identity, sandboxing, and compliance across stacks, and Veto for a single deterministic gate with portable receipts.
Code Atelier Governance SDK: a Python and Postgres SDK with HITL gates and an HMAC audit chain; choose it when your stack is Python and Postgres, and Veto when you want framework-agnostic wrapping and a hosted approval inbox.
SettleBridge: trust and settlement for agent-to-agent commerce; a different layer, since Veto authorizes a tool call while SettleBridge settles an economic obligation.

Bottom line
#

Recommended for teams that put money, data, or customer-facing actions behind a deterministic pre-execution gate with approval routing and verifiable receipts. Not for teams that need a full org control plane with budgets and chain of command, or that require a large open-source community before adopting.

Changes
#

2026-09-27 - Created.

References
#

https://veto.so/ - product framing, supported frameworks, EU AI Pact claim
https://veto.so/pricing - Developer, Hosted, and Enterprise plans with dollar amounts
https://github.com/PlawIO/veto - README: protect(), rules, adapter matrix, benchmarks, BYOC boundary
https://api.github.com/repos/PlawIO/veto - stars, forks, issues, push dates as of 2026-09-27
https://docs.veto.so - documentation: MAP artifacts, local runtime, receipts, adapters
https://api.github.com/repos/PlawIO/veto/releases - veto-sdk@2.9.3, 2026-05-07

policy-enforcement on tomrochette.com

Code Atelier Governance SDK

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

Microsoft Agent Governance Toolkit

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

SettleBridge

What it is #

Status #

Strengths #

Cautions #

Pricing #

Price history #

Compared to #

Bottom line #

Changes #

See also #

References #

Veto

What it is #

Status #

Strengths #

Cautions #

Pricing #

Price history #

Compared to #

Bottom line #

Changes #

See also #

References #

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Price history
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Price history
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#