Other tools test prompts. Other tools validate outputs. Kite Logik governs the agent itself: its tool access, its delegations, its resource budgets. Enforced by infrastructure. Not by the model.
pip install kitelogikEvery AI safety tool in this space operates at the wrong layer. Prompts can be overridden, confused, and manipulated. Infrastructure cannot.
Each layer has a distinct role. Together they make it structurally impossible for an agent to violate policy, regardless of what it's told.
Not just tool calls. Agent spawn, delegation, plans, resource budgets, and data access. All policy-controlled through the same pipeline.
One decorator. One policy file. Full governance pipeline: policy evaluation, credential check, audit log, OpenTelemetry trace.
from kitelogik import governed, PolicyGate, OPAClient, SessionContext gate = PolicyGate(opa_client=OPAClient()) ctx = SessionContext( session_id="s1", user_role="support", session_scopes=["read_customer", "approve_refund"], ) @governed(gate=gate, context=ctx) async def approve_refund(customer_id: str, amount: float) -> str: return payment_api.refund(customer_id, amount) # approve_refund("cust_123", 50) -> OPA allows, runs # approve_refund("cust_123", 5000) -> OPA denies, raises GovernanceError
version: 1 rules: - name: block_high_refunds when: action: approve_refund args.amount: { gt: 1000 } then: deny reason: "Refunds over $1000 require escalation"
OpenAI, LangChain, CrewAI, Google ADK, Pydantic AI, LlamaIndex, and 5 more. Same governance pipeline across all of them.
Write policies in YAML and compile to Rego with kitelogik compile. Or write Rego directly for full OPA power.
Policy evaluation adds <8ms per tool call against a local OPA. Ships with an OPA HTTP client; experimental in-process Rego via RegorusClient.
Every policy starts with default allow := false. If OPA is unreachable, the gate returns BLOCK. Never an accidental allow.
Drop governance into your existing agent with a single import. All adapters share the same policy engine, audit log, and credential lifecycle.
Every action is classified at evaluation time. The tier determines the default enforcement outcome. You can override any default in Rego.
| Tier | Name | Examples | Default outcome |
|---|---|---|---|
| 01 | INFORMATIONAL | Read customer record, list transactions | ● Auto-allow |
| 02 | OPERATIONAL | Update record, send notification | ● Allow with scope |
| 03 | TRANSACTIONAL_HIGH | Approve refund > $1000, wire transfer | ● HITL escalation |
| 04 | DESTRUCTIVE | Delete records, bulk operations | ● HITL or block |
| 05 | SECURITY_CRITICAL | Shell exec, credentials, file system | ✕ Hard block |
Guardrails AI, NeMo Guardrails, AWS Bedrock all operate on LLM inputs and outputs. None of them intercept the agent's actions.
| Tool | Enforcement layer | Tool-call governance | Policy-as-Code | HITL | Audit trail |
|---|---|---|---|---|---|
| Kite Logik | Agent actions | ✓ Yes | ✓ OPA / Rego | ✓ Async | ✓ Immutable |
| Guardrails AI | LLM output | ✕ | ✕ | ✕ | ✕ |
| NeMo Guardrails | LLM I/O | ✕ | ~ Colang | ✕ | ✕ |
| AWS Bedrock Guardrails | Inference | ✕ | ✕ | ✕ | ~ Limited |
| LangSmith | Observability | ✕ | ✕ | ✕ | ✓ Tracing |
| Lakera Guard | Prompt / response | ✕ | ✕ | ✕ | ~ Limited |
Side-by-side comparisons against the tools you're probably evaluating, plus the concepts behind why action-layer governance matters.
No account. No API key. No dashboard required.
pip install kitelogik
docker compose up -d opa
kitelogik init my-agent
Creates a policy.yaml, compiles to Rego, generates agent.py
cd my-agent && python agent.py
Watch ALLOW / BLOCK decisions in real time
The full governance pipeline. Policy engine, HITL queue, credential broker, audit trail, 11 framework adapters, and a CLI.
Everything in open source, plus centralized enforcement, SSO, fleet management, compliance exports, and dedicated support.