Most teams bolt governance onto a working agent and discover the retrofit never holds. This SDK executes the opposite order: identity declared, authority bound, every consequential action admitted before it runs, every outcome sealed — governance as the execution path, not a wrapper around it. The result is an agent your compliance team can counter-sign.
A capability without these answers is a liability with a demo. The schedule below is what the SDK enforces per action — and what an auditor reads back.
| Field | The question it closes | Enforced |
|---|---|---|
| Principal | Which declared identity is acting — an agent as a first-class principal, never an anonymous process. | ✓ at construction |
| Authority | Under whose delegation, within which purpose scope and limits. | ✓ bound, kill-switched |
| Admission | Was this specific action decided before it ran — deny fails closed with a routed refusal. | ✓ pre-execution |
| Approval | Which acts need a human counter-signature, and from whom. | ✓ threshold-routed |
| Evidence | What sealed proof each outcome leaves — success and refusal alike. | ✓ per action |
| Audit | Can the whole run be replayed and verified from public keys alone. | ✓ replay-stable |
| Exception | What happens when the engine is unreachable — the verdict path never fails open. | ✓ fails closed |
| Rollback | How a bad action is unwound, and who is notified. | ✓ evidenced |
The agent is born with canonical identity and a declared class — registered, discoverable, revocable.
Purpose scope, tool allow-list, spend and data limits attach at construction and cannot be shed at runtime.
Every consequential action is decided by the real engine before its body executes. Your logic stays yours; the boundary is not negotiable.
The agent does its work on whatever framework you already use — the SDK governs it, and deliberately is not another framework.
Every outcome seals evidence; the run as a whole is auditable, replayable, and provable offline.
You answer for what they do. This SDK makes the answer pre-written: every consequential act arrives with its authority, approval, and evidence attached.
Schedule A is your review checklist rendered executable — eight fields enforced per action instead of promised per policy.
Your framework stays; the boundary comes from the SDK. "Enterprise-ready" stops being a slide and becomes a construction property.
Sign-off in days, not quarters. The retrofit audit disappears — governance was the execution path from the first line.
Incidents become bounded. A misbehaving agent hits a kill-switched binding and a fails-closed boundary, not a postmortem.
Every run is replayable. Auditors verify from public keys alone; nobody reconstructs intent from logs.
No framework migration. The SDK governs whichever agent stack you already chose — it deliberately is not another one.
Sample instrument — illustrative names, the real fields Schedule A binds.
The retrofit audit never happens. Governance bolted on after the fact is re-reviewed on every change; governance as the execution path is reviewed once, at Schedule A.
Incident cost is bounded ex ante. Kill-switched bindings and fail-closed boundaries convert a would-be postmortem into a refused, evidenced act.
Evidence collection costs zero marginal effort. It is a by-product of execution — the auditor's request is a replay, not a project.
No framework spend is stranded. The SDK governs the stack you already run; nothing is migrated to adopt it.
| Instrument | Provides | Omits |
|---|---|---|
| Agent frameworks | Execution: tools, loops, memory | A boundary they cannot grant themselves — the runner cannot referee its own runs. |
| Observability / evals | What the agent did, measured after | Stopping the inadmissible act before it runs; evidence that binds authority, not just output. |
| Policy documents | Intent, beautifully stated | Enforcement. A wiki page has never refused an action. |
| This SDK | Pre-execution admissibility + per-act sealed evidence, framework-agnostic. The moat: governance as a construction property cannot be retrofitted by competitors bolted on outside the execution path — and every attested run deepens an evidence corpus that only accrues to the layer holding the boundary. | |
Payments, KYC, case decisions, customer data — teams putting agents in front of acts that matter receive access first. A person replies from info@agentpayment.dev.