Autonomous agents, governed before they act

Agent frameworks optimize for capability. Regulators ask who authorized the action.

An autonomous agent chains tool calls, writes to systems, and contacts the outside world without a human in the loop. Most agent stacks have no enforcement point between “the model decided” and “the action executed,” and no tamper-evident record of what was authorized. For a regulated operator, that is an unbounded liability.

Every agent action transits the same governance pipeline as a single decision

An agent doesn’t execute actions directly. It proposes them. Each proposed action passes through the Action Registry’s propose → approve → execute workflow: a charter compliance check (HARD_BLOCK vetoes cannot be overridden), six cognitive locks that must clear before any external tool use, and the Autonomous Action Policy that decides — from the action’s tier and the agent’s earned trust — whether it auto-executes, needs human confirmation, or is blocked. Each approval issues an HMAC-signed execution token bound to that exact action, and every outcome — allowed, confirmed, or blocked — emits a signed Decision Certificate, appended to a per-tenant hash chain and verifiable offline with the published ECDSA P-384 public key.

A runtime where autonomy is bounded and every action is provable

Safe actions move at machine speed; risky ones wait for a human

The Autonomous Action Policy classifies every action type into one of four tiers. The tier sets the default approval mode; an agent’s autonomy scope and earned trust can tighten it (low autonomy upgrades a safe action to confirmation) but can never weaken a charter HARD_BLOCK.

An agent proposes; the runtime decides and signs

Agents route actions through the governed runtime instead of executing them directly. It runs the charter veto, cognitive locks, and the tiered policy, then auto-executes safe tiers and holds risky ones for a human — returning a signed Decision Certificate for the outcome. The same governed surface is exposed over HTTP at /api/autonomous/*.

from core.autonomy.governed_action_runtime import get_governed_action_runtime

runtime = get_governed_action_runtime()

# An agent proposes an action — it does not execute it directly. The runtime
# runs the charter veto + cognitive locks + tiered policy, then (for safe tiers)
# approves and executes; risky tiers wait for a human. Every outcome is signed.
verdict = runtime.propose(
    action_type="external.web_search",
    agent="world_observer_agent",
    params={"query": "fair lending guidance 2026"},
    autonomy_scope="PROACTIVE",
)

verdict["disposition"]   # "EXECUTED" | "REQUIRES_CONFIRMATION" | "BLOCKED"
verdict["tier"]          # "auto_execute_with_log"  (Tier 2)
cert = verdict["certificate"]   # signed eve.agent.action.v1 Decision Certificate

# Same governed surface over HTTP — verify a certificate offline, no secret:
#   POST /api/autonomous/actions/propose          -> verdict + signed certificate
#   POST /api/autonomous/actions/{id}/approve     -> approve a Tier-3 action
#   GET  /api/autonomous/certificates/chain       -> hash-chain integrity proof
#   POST /api/autonomous/certificates/verify       ·  GET /.well-known/eve-pubkey

The runtime governs your agents. It does not replace your framework.

EVE Agent Infrastructure is the governance and evidence layer around agent actions. It runs alongside your agents (or EVE’s own agent mesh), not as a replacement for your orchestration framework. Policy evaluation runs on EVE’s hosted governance plane — no model weights or governance logic ship into your environment.

What ships today, and what is coming

We are explicit about the current edges. The governance core is live; the productized surfaces for governing your agents are landing by tier.

The next layer: an agent holds no standing credential

The runtime above authorizes an action and hands the executor a signed, action-bound token. The layer we are building removes standing access entirely: an agent has no usable credential until EVE approves the exact action — then EVE mints a single-use, parameter-bound authorization and, for a real executor, brokers a short-lived, least-privilege credential scoped to that one action. This layer is authored and tested in isolation — a dedicated, offline test suite (all passing), no LLM in the decision path, on the feature/proof-bound-agent-execution branch. It is not merged, not deployed, and not in the live /api/autonomous/* path. We show it here so the public record matches the code, not ahead of it.

Don’t take our word for it — verify a signed certificate

Every governed agent action emits a signed Decision Certificate, hash-chained and verifiable offline against our published ECDSA P-384 public key — no secret, no callback to EVE. Run the checks in your browser, then tamper with a certificate and watch verification fail.

Agent attempts an external API call

1. 1Agent proposes the action. An autonomous agent tries an outbound external.api_call. The runtime intercepts it before anything executes.
2. 2Tier 3 — requires confirmation. The tiered autonomy policy maps external API calls to Tier 3: the action is held for human approval, not executed.
3. 3Signed certificate on execute. On approval, EVE runs the call and emits a Decision Certificate (schema eve.agent.action.v1), hash-chained to the prior action and signed with the production ECDSA P-384 key.
4. 4Tamper → verification fails. Anyone verifies the certificate offline against the public key. Change a single field and the signature check fails — the record is tamper-evident. Try it yourself →