Quickstart

Add governance to your TypeScript AI agents in under 5 minutes. No API keys, no external services, no runtime dependencies.

1. Install

npm install governance-sdk
# or: pnpm add governance-sdk
# or: yarn add governance-sdk

Note: Zero runtime dependencies. TypeScript types included. Works in Node.js, Bun, Deno, and edge runtimes.

2. Create a governance instance

import {
  createGovernance,
  blockTools,
  requireApproval,
  requireLevel,
} from 'governance-sdk';

export const gov = createGovernance({
  rules: [
    blockTools(['shell_exec', 'db_drop', 'fs_write']),
    requireApproval(['payment', 'data_access']),
    requireLevel(2), // Agents must score L2+ (Managed)
  ],
});

Export as a singleton — all agents share the same policy set. Rules are evaluated in priority order; higher priority wins.

3. Register your agent

const agent = await gov.register({
  name: 'sales-agent',
  framework: 'mastra',
  tools: ['email_draft', 'crm_update', 'search'],
  hasAuth: true,
  hasGuardrails: true,
  hasAuditLog: true,
});

// agent.score    → 68
// agent.level    → 3
// agent.status   → "approved"

Tip: The 7-dimension score is computed instantly at registration time. See Governance Scoring for the full model.

4. Enforce before every tool call

const decision = await gov.enforce({
  agentId: agent.id,
  action: 'tool_call',
  tool: 'shell_exec',
});

if (decision.blocked) {
  // Stopped before execution. Audit event written.
  return { error: decision.reason };
}

// ✓ Allowed — proceed
await executeTool('shell_exec', params);

Note: Every enforce() call automatically writes to the audit trail — decision, agent ID, tool, timestamp, and matching policy rule.

5. Or use a framework adapter

Skip manual enforce() calls — adapters wrap your tools automatically. One line per framework.

import { createGovernanceMiddleware } from 'governance-sdk/plugins/mastra';
const middleware = await createGovernanceMiddleware(gov, {
  agentName: 'sales-agent', owner: 'sales-team',
});

import { createGovernedTools } from 'governance-sdk/plugins/vercel-ai';
const { tools } = await createGovernedTools(gov, rawTools, {
  agentName: 'assistant', owner: 'product-team',
});

import { governTool } from 'governance-sdk/plugins/langchain';
const governed = governTool(gov, searchTool, {
  agentName: 'research-agent',
});

See all 20 adapters in Framework Adapters.

Check: You're governed. Every tool call is now policy-evaluated before execution, written to a tamper-evident audit trail, and contributing to your agent's governance score. Next: Policy deep-dive · Injection detection · EU AI Act compliance