Let agents work.
Keep control.

Check a proposed tool call before it runs. Keep the decision for review.

CONTROL AT THE POINT OF ACTION

Check before execution Stop on escalation Inspect the evidence

One proposed action.
One clear decision.

Explore the kernel's four verdicts. ALLOW and TRANSFORM can authorize a verified call. DENY and ESCALATE stop execution.

Follow the execution path

ONE ACTION. A CLEAR BOUNDARY.Interactive example

Agent requests an action01

Read a project document

Agent: research-assistant
Tool: documents.read
Scope: Project Atlas / approved files

gove-zone boundaryCheck the action before the tool runs

Illustrative decision✓ Allowed

Read access is permitted within this project.

policy / project-readMay proceed

Illustrative policy outcomes. No signed receipts are generated and no tools are executed.

A good answer is not permission to act.

An agent can propose a useful action and still exceed its authority. gove-zone brings your policy into the integrated execution path, where the decision matters.

Define the scope

Set which actions, resources, and conditions are allowed for a governed tool.

Your policyRead approved project files

Check the request

Evaluate the proposed action and issue its decision receipt. A transformed call uses only the approved arguments.

The decisionAllow, transform, deny, or escalate

Verify, then execute

Check the receipt against the exact call before running the tool. Retain the decision and audit record for review.

Your recordExact call and verified decision

The integrating runtime routes tools through the governed executor. Coverage depends on those integration points.

What should your agent be allowed to do?

Choose the action you want to control. Begin with one local evaluation and expand only after you understand its scope.

gove-zone

Control a tool call

Require authorization before an integrated action runs.

Start with one tool and an explicit execution boundary.Open evaluation guide Beta · release candidate ACGS-Lite

Check a Python action

Evaluate a request against your configured policy.

Start with a local policy check, then inspect governed wrappers.Open evaluation guide Beta CFT Governance Pack

Review a cloud plan

Check a Google Cloud Terraform plan before apply.

Start with plan JSON; your pipeline enforces the result.Open evaluation guide Early source companion

Coordinating multiple agents?

Explore task ownership, peer validation, and messaging as separate building blocks.

ACGS Swarm Enhanced Agent Bus

Compare all five products Review product evidence

Where autonomy meets responsibility.

Start with one consequential action. Make its permissions and review requirements explicit before expanding the workflow.

DOCUMENT & CLIENT WORKFLOWS

Draft freely.
Release deliberately.

Explore matter-scoped document access and review before client communication or submission. The local example uses mock tools.

CLOUD INFRASTRUCTURE

Check the plan.
Before the change.

Evaluate Google Cloud Terraform plans for configured IAM, network, and resource rules. Your CI pipeline enforces the result before apply.

AGENT TOOL EXECUTION

Authorize this call.
Within this scope.

Bind a decision to the actor, tool, and exact arguments. At the integrated executor, deny or escalate outcomes stop the call.

Source-backed evaluation examples. Customer deployments and business results are not claimed.

Try a Python policy check.

ACGS-Lite is a Python starting point for evaluating policy. Install the pinned release, follow the setup guide, and inspect how allowed and denied requests are handled.

Open the Lite setup guide

Need to authorize execution?

A policy check alone does not gate a tool call. Inspect the executor integration separately.

Evaluate the gove-zone boundary

acgs-liteLocal evaluation

pip install acgs-lite==2.12.0

Python 3.10+ · Beta · GitHub release v2.12.0

WHAT TO EVALUATE

Allowed requestDoes the intended action pass with the right scope?

Execution integrationHave you wired the explicit receipt gate before the tool call?

Evidence configurationHave you selected full audit mode and the storage you need?

Explore the Lite package

Know what the boundary covers.

Review the current evidence

Explicit integration

Only tool paths routed through the governed executor are covered. The runtime is not a sandbox for every action an agent could take.

Configuration matters

Signing, replay protection, identity, and audit storage depend on the package and deployment configuration. Verify the controls you intend to rely on.

Evaluate before production

Review release status, operational requirements, and current evidence. A package or policy outcome does not establish regulatory compliance.

Before you get started.

Where does ACGS fit in an agent workflow?

Between the proposed tool action and the code that executes it. Your integration supplies the request and identity context, evaluates policy, and checks the receipt at the governed execution boundary.

Does this replace my existing agent framework?

The focus is the tool execution boundary. Evaluate the documented adapter or hook for your framework and confirm that every tool path you intend to govern actually passes through it.

Is this a managed production service?

The local runtime and Python package are evaluation starting points. Check their current release status and limitations. Hosting, identity, key management, storage, and operational controls require a deployment-specific assessment.

What does a decision receipt prove?

A receipt records a policy decision about a request. Its authenticity and enforceability depend on verification, action binding, and the integrating executor. A receipt alone does not prove that an external action succeeded or that a deployment meets compliance requirements.

Put one real workflow under your control.

Choose one tool. Define what it may do. Inspect what happens when a request crosses the boundary.

Choose an evaluation Compare all products

Let agents work.Keep control.

One proposed action.One clear decision.