Demo: CoreGuard blocks a prohibited action before it executes

EVE CoreGuard makes a deterministic policy decision (ALLOW / BLOCK / MODIFY) before a governed action executes. No LLM is in the CoreGuard decision path; the verdict is computed by deterministic policy code. This demo shows a permitted call executing and a prohibited call being blocked with zero side effects.

Everything below uses synthetic fixtures and a recording tool. No production credentials, no network side effects.

Readiness

• EVE SDK core: RELEASE CANDIDATE WITH EXCLUSIONS.
• CoreGuard deterministic evaluation: PILOT_READY (pilot-validated core governance architecture).
• Python SDK eve-coreguard 0.2.2 — release-candidate core client. Not published to a public registry yet; install from a pilot/private artifact.
• This demo runs against the in-process embedded governance facade shipped with the EVE service. The pip client governs via hosted mode (needs a reachable endpoint); embedded in-process evaluation is the service.

Setup

Synthetic identity and a recording tool that appends to a list instead of performing a real side effect:

# demo_coreguard_block.py — synthetic fixtures only
from core.eve_sdk import EVE

IDENT = {"tenant_id": "acme", "principal_id": "agent-1", "session_id": "sess-1"}
executions = []  # recording target — proves whether the tool ran

def create_loan(**kwargs):
    """Synthetic recording tool. Records the call; no real side effect."""
    executions.append(kwargs)
    return {"loan_id": "L-1001", "status": "created"}

Package facts: Python from eve_coreguard import EVE (client, hosted mode). This runnable demo uses the in-repo embedded facade from core.eve_sdk import EVE so it executes offline without an endpoint.

Code

eve = EVE(policy="lending_v1", mode="embedded")

# 1) Permitted low-risk call -> ALLOW -> the tool executes.
low = eve.govern_tool_call(
    tool="loan_approval",
    arguments={"amount": 1000},
    context=IDENT,
)
assert low.allowed, "permitted call must be ALLOW"
if low.allowed:
    create_loan(amount=1000)
assert len(executions) == 1

# 2) Prohibited high-risk call -> BLOCK -> the tool must NOT execute.
high = eve.govern_tool_call(
    tool="loan_approval",
    arguments={"amount": 500000},
    context={**IDENT,
             "credit_score": 480, "debt_to_income": 0.9, "employment_verified": False},
)
assert not high.allowed, "high-risk call must be BLOCK"
# Do not call the tool on a BLOCK verdict.
assert len(executions) == 1, "blocked call must cause zero tool side effects"

print("decision:", high.action, high.reason_codes)
print("evidence certificate present:", high.certificate is not None)

Expected decision

The verdict field reports BLOCK, with policy-derived reason_codes. certificate.llm_in_decision_path == false.

Expected evidence

The BLOCK decision produces a signed decision-evidence record bound to the decision:

{
  "action": "BLOCK",
  "reason_codes": ["..."],
  "decision_id": "...",
  "certificate": {"content_hash": "...", "signature": "ed25519-...", "canon": "jcs-1",
                  "llm_in_decision_path": false}
}

Ed25519 is used in production configuration; an HMAC-SHA256 fallback is symmetric and not independently verifiable.

Verification command

from core.eve_sdk import verify_evidence
v = verify_evidence("decision", high.certificate, expected_tenant="acme")
assert v["valid"], v.get("reason")
print("verify:", v["valid"])   # -> True

verify_evidence proves the evidence is authentic and unaltered; it does not attest the correctness of the underlying decision.

Zero-side-effect assertion

len(executions) == 1 after both calls: only the ALLOW call ran the tool. The BLOCK verdict never invokes create_loan. The recording list is the independent witness that no side effect occurred on BLOCK.

Cleanup

executions.clear()   # in-memory fixture; nothing else to tear down

No files, network calls, or external state were created.

Limitations

• CoreGuard is PILOT_READY, not production. The zero-LLM property applies to the governance verdict only; the governed application may still use LLMs.
• The pip client SDK reaches CoreGuard via hosted mode (needs an endpoint); embedded in-process evaluation runs inside the EVE service.
• On a BLOCK, EVE decides — it cannot execute the tool on your behalf. Enforcement depends on your code honoring the verdict (call the tool only when allowed is true) or routing through a gateway/sidecar for hard enforcement.