EVE Agent Governance

Deterministic monitoring, sequence, and budget controls for AI agents — with signed evidence.

Who this is for

Teams running autonomous or semi-autonomous agents that call tools, and who need more than a single per-call check. You want to observe an agent's behavior over time, block combinations of individually-permitted actions, and cap resource consumption — deterministically, with records you can verify.

The problem

A per-call ALLOW/BLOCK gate does not catch an agent that does everything "allowed" but in a pattern that is harmful in aggregate: reading a little data on each call until it has exfiltrated a lot, or chaining permitted steps into a prohibited sequence, or looping until it exhausts a budget. You need governance that reasons across calls, not just within one.

Supported capabilities

  • Signed monitoring envelopes. EVE produces signed monitoring envelopes summarizing agent behavior over a window (core/agent_monitoring/envelope.py).
  • Behavioral anomaly detection. EVE detects behavioral anomalies using deterministic statistical detectors (rolling/robust z-score, EWMA, CUSUM) in core/agent_monitoring/detectors.py.
  • Action-sequence governance. EVE can block individually-permitted actions that combine into a prohibited sequence (core/agent_monitoring/sequence.py).
  • Deterministic budget controls. EVE enforces deterministic budget/resource limits; a permitted call executes until the configured limit is reached (core/agent_monitoring/budget.py).
  • Framework adapters. EVE ships framework adapters that route tool calls through the same governance composition root. The generic adapter is validated; adapters for OpenAI Agents, Claude Agent SDK, LangChain, LangGraph, CrewAI, and Vercel AI SDK are structurally implemented but experimental (not validated against pinned live framework versions).

Readiness: monitoring, anomaly detection, sequence, and budget controls are PILOT_READY. Framework adapters other than the generic adapter are EXPERIMENTAL.

How it works

  1. Tool calls are routed through a governance composition root (directly, or via a framework adapter).
  2. Each call can be gated by CoreGuard's deterministic verdict (ALLOW / BLOCK / MODIFY).
  3. Monitoring records behavior across a window; deterministic detectors flag statistical deviations.
  4. Sequence rules block prohibited combinations; budget counters block calls once a configured limit is reached.
  5. A signed monitoring envelope summarizes the window and can be verified offline.

Monitoring is observational; enforcement decisions are made by CoreGuard, sequence, and budget controls.

Technical example (Python)

from eve_coreguard import EVE

eve = EVE(policy="enterprise-default", mode="hosted",
          endpoint="https://your-endpoint", api_key="eve_sk_...")

result = eve.govern_tool_call(
    tool="db.read",
    arguments={"table": "customers", "rows": 500},
    context={"tenant_id": "org_abc", "principal_id": "agent_7", "session_id": "run_42"},
)
# A single db.read may ALLOW; the same call repeated can trip a
# sequence rule or a budget limit and return BLOCK.
# govern_tool_call returns a plain dict.
print(result["action"], result["reason_codes"])

Signed evidence example

Anomaly and budget findings, and the window summary, are captured as records:

{
  "anomaly_event": { "detector": "robust_zscore", "z_score": 4.1, "escalation": "…" },
  "budget_finding": { "limit": 1000, "consumed": 1000, "exceeded": true },
  "monitoring_envelope": { "window": "…", "signature": "ed25519-…", "canon": "jcs-1" }
}

Verifier example

import { verifyEvidence } from "@eve/coreguard";
const report = verifyEvidence(monitoringEnvelope, { publicKeyPem });
// { valid: true, signature: "ed25519-valid" }

Deployment options

Monitoring, sequence, and budget controls run embedded inside the EVE service. Tool-call routing is available through the generic adapter (validated) and experimental framework adapters. Hard enforcement of an agent's tool calls requires a gateway or sidecar, not a wrapper adapter alone.

Readiness

Monitoring envelopes, behavioral anomaly detection, sequence governance, and budget controls are PILOT_READY (pilot-validated core governance architecture). Framework adapters other than the generic adapter are EXPERIMENTAL. The EVE SDK core overall is a RELEASE CANDIDATE WITH EXCLUSIONS.

Limitations

  • Monitoring is observational; it does not enforce on its own. Enforcement comes from CoreGuard, sequence, and budget controls.
  • Statistical anomaly detectors flag deviations and are advisory unless wired to a deterministic enforcement action.
  • In the pilot, sequence state is per-session and in-process; durable multi-instance state is a deployment concern. Budget counters are deterministic, but durable cross-instance budgets require a shared store.
  • Only the generic adapter is validated. Framework adapters (OpenAI Agents, Claude Agent SDK, LangChain, LangGraph, CrewAI, Vercel AI SDK) are experimental and untested against pinned live versions. Wrapper-enforced adapters can be bypassed by a direct call to the underlying tool; Claude Code hooks are cooperative and are not an unbypassable boundary; the Vercel adapter is server-only. Hard enforcement requires a gateway or sidecar.
  • The release-candidate clients are distributed privately for pilots — install the pilot artifact, not a public pip/npm install (see readiness for public-registry status).

Next step

Request a pilot to wire your agents through the generic adapter or a gateway/sidecar and evaluate sequence and budget controls against your own runs.

Part of the EVE AI Core control plane Deterministic AI Governance Control Plane → Policy decisions that return the same result for the same input every time, before execution.