Open source · Apache-2.0 · npm i @11ai/execution-governance

Authorize every agent action before it runs.

Execution Governance™ evaluates each AI agent tool call against your policy and returns allow or deny before execution. Fail-closed. A signed receipt on every decision.

Request -> Verify -> Allow or Deny -> Execute -> Proof

npm install @11ai/execution-governance

npx eg-demo

Read the code Verify a live decision

The 30-second proof

A prompt injection, denied before it runs.

execution-governance demo

$ npm install @11ai/execution-governance
$ npx eg-demo

  11/11 Execution Governance demo
  policy: eg-policy.yaml   receipts: eg-receipts.jsonl

  DENY   exfiltration: outbound call carrying secret material
         receipt 01a11ee2-1e2d-77d1-9952-d3d337b58dd6  signed: true
         the http.post never ran. Nothing left the machine.
  ALLOW  safe GET allowed  -> ok

  Verify the receipts yourself, on this machine, with no network:

    npx eg-verify --receipts ./eg-receipts.jsonl \
      --pubkey b-MFsREjvVVe896gjBjlIuNZcv0SpaX2WqREav6vuaU

  The signing key was generated for this run and not saved, so the
  public key above is the only one that verifies these receipts.

The agent obeyed the injection. The gate denied it. Every decision is a signed receipt you can verify yourself. Real output from a clean install of 0.4.2. The receipt id and public key are from that run, so yours will differ. The key is generated per run and never saved, which is why the demo prints it.

Pre-execution authorization

The decision happens before the action, not after. A denied call never runs.

Fail-closed

Any error, timeout, unreachable engine, or missing decision is a deny. There is no fail-open path.

Cryptographic proof

Every decision is canonical JSON, sha3-512 hashed, Ed25519 signed, and chained.

MCP gateway

Gate an existing MCP server by changing one line of config.

mcp config

{
  "command": "npx",
  "args": ["-y", "@11ai/mcp-gate", "--policy", "eg-policy.yaml", "--", "node", "their-server.js"]
}

The proxy passes initialize, tools/list, and notifications through untouched. A tools/call is gated. A denied call is answered with a JSON-RPC error and never reaches the server.

Measured, not claimed