EnforceCore

The runtime enforcement layer for agentic AI systems.
Policy-driven · Fail-closed · Tamper-proof audit trails

Quick Start · Architecture · Roadmap · API Reference · Contributing

⚠️ Disclaimer: EnforceCore is provided "as is", without warranty of any kind, express or implied. It is a technical enforcement tool — not a compliance certification. Using EnforceCore does not guarantee regulatory compliance with any standard or law. See DISCLAIMER.md and LICENSE for full legal terms.

The Problem

Most agent safety solutions operate at the prompt level — they ask the LLM to be safe. This is fundamentally broken: prompts can be bypassed, jailbroken, or ignored.

EnforceCore operates at the runtime boundary — the moment before a tool or API is actually called. At this layer, enforcement is mandatory, not advisory. If a call violates policy, it never executes. Period.

from enforcecore import enforce

@enforce(policy="policies/strict.yaml")
async def search_web(query: str) -> str:
    """This call is policy-enforced before execution."""
    return await api.search(query)

Why EnforceCore?

EnforceCore vs. OS-level security: EnforceCore operates at the application semantic layer — it understands tool calls, PII, and cost budgets. It does not replace SELinux, AppArmor, seccomp, or container sandboxing. These are complementary — use both for defense-in-depth.

Architecture

  ┌───────────────────────────────────────────────────────────────┐
  │        Agent  (LangGraph · CrewAI · AutoGen · Python)         │
  └───────────────────────────────┬───────────────────────────────┘
                                  │  tool_call(args)
                                  ▼
                    ┌─────────────────────────┐
                    │   @enforce(policy=…)    │  ← decorator / adapter
                    └─────────────┬───────────┘
                                  │
  ╔═══════════════════════════════▼═══════════════════════════════╗
  ║                           Enforcer                            ║
  ║                                                               ║
  ║  ┌─────────────────┐  ┌─────────────────┐  ┌─────────────┐    ║
  ║  │  Policy Engine  │  │    Redactor     │  │    Guard    │    ║
  ║  │ ─────────────── │  │ ─────────────── │  │ ─────────── │    ║
  ║  │  YAML rules     │─▶│  PII detect     │─▶│ time · mem  │    ║
  ║  │  allow / deny   │  │  & redact       │  │ cost · kill │    ║
  ║  └─────────────────┘  └─────────────────┘  └──────┬──────┘    ║
  ║                                                    │          ║
  ║  ┌─────────────────────────────────────────────────▼───────┐  ║
  ║  │                       Audit Trail                       │  ║
  ║  │          Merkle chain · tamper-proof · always logs      │  ║
  ║  └─────────────────────────────────────────────────────────┘  ║
  ╚═══════════════════════════════════════════════════════════════╝
                                  │
               ┌──────────────────┴──────────────────┐
               ▼                                     ▼
       ✅  allowed                             ❌  blocked
        → execute tool                      → raise PolicyViolation

Quick Start

Install

pip install enforcecore

1. Define a Policy

# policy.yaml
name: "my-agent-policy"
version: "1.0"

rules:
  allowed_tools:
    - "search_web"
    - "calculator"
    - "get_weather"
  denied_tools:
    - "execute_shell"
  max_output_size_bytes: 524288   # 512KB

on_violation: "block"

2. Protect Your Tools

from enforcecore import enforce

# Decorator — sync or async, just works
@enforce(policy="policy.yaml")
async def search_web(query: str) -> str:
    return await api.search(query)

@enforce(policy="policy.yaml")
def calculator(expr: str) -> float:
    return eval(expr)  # policy controls whether this tool can be called

How tool names work: @enforce uses the function name (e.g. search_web) as the tool name matched against allowed_tools / denied_tools. To override, pass tool_name=:

@enforce(policy="policy.yaml", tool_name="web_search")
async def search(query: str) -> str: ...

3. See It Work

# ✅ Allowed — tool is in the allowed list
result = await search_web("latest AI papers")

# ❌ Blocked — tool not allowed, raises ToolDeniedError
@enforce(policy="policy.yaml")
async def execute_shell(cmd: str) -> str:
    return subprocess.run(cmd, capture_output=True).stdout

4. Programmatic Control

from enforcecore import Enforcer, Policy

policy = Policy.from_file("policy.yaml")
enforcer = Enforcer(policy)

# Direct invocation (sync)
result = enforcer.enforce_sync(my_tool, arg1, arg2, tool_name="my_tool")

# Direct invocation (async)
result = await enforcer.enforce_async(my_tool, arg1, tool_name="my_tool")

📖 See examples/quickstart.py for a complete runnable demo.

Framework Integrations

EnforceCore works with any Python-based agent system — no lock-in:

# LangGraph — one-line enforcement
from enforcecore.integrations.langgraph import enforced_tool

@enforced_tool(policy="policy.yaml")
def search(query: str) -> str:
    """Search the web."""
    return web_search(query)

# CrewAI
from enforcecore.integrations.crewai import enforced_tool

@enforced_tool(policy="policy.yaml")
def calculator(expr: str) -> str:
    """Calculate."""
    return str(eval(expr))

# AutoGen
from enforcecore.integrations.autogen import enforced_tool

@enforced_tool(policy="policy.yaml", description="Search the web")
async def search(query: str) -> str:
    return await web_search(query)

No hard dependencies on any framework — adapters use optional imports.

Key Design Principles

• 🔒 Fail-closed — if enforcement fails, the call is blocked. Never fails open.
• ⚡ Async-native — first-class support for both sync and async from day one.
• 🌍 Cross-platform — core works on Linux, macOS, and Windows. Advanced Linux hardening optional.
• 📦 Zero lock-in — no hard dependency on any agent framework.
• 📊 Honest benchmarks — real overhead numbers, not marketing claims.

Performance

Measured with 1 000 iterations + 100 warmup on Apple Silicon (arm64), Python 3.13. Run python -m benchmarks.run for your hardware. See docs/benchmarks.md for methodology.

Negligible compared to tool call latency (100ms–10s for API calls).

Roadmap

See docs/roadmap.md for the full roadmap including component details and future directions.

Documentation

For Researchers

EnforceCore applies established computer science principles — runtime verification, reference monitors, information-flow control — to the novel problem of AI agent safety. We welcome academic collaboration.

• 📄 Related Work — survey of runtime verification for AI agents, positioning vs. NeMo Guardrails, LlamaGuard, and others
• 📑 CITATION.cff — machine-readable citation metadata (how to cite)
• 🔬 Open Research Questions — policy composition, temporal properties, adversarial robustness
• 🧪 Evaluation Suite — reproducible adversarial benchmarks with 26 scenarios across 11 threat categories
• 📐 Architecture — formal design with Mermaid diagrams

Citation

@software{enforcecore2026,
  title  = {EnforceCore: Runtime Enforcement Layer for Agentic AI Systems},
  author = {{AKIOUD AI}},
  year   = {2026},
  url    = {https://github.com/akios-ai/EnforceCore},
  license = {Apache-2.0}
}

For Enterprises

EnforceCore is designed for production deployment in regulated environments.

• 🔒 Fail-closed by default — if enforcement fails, the call is blocked
• 📦 No vendor lock-in — Apache 2.0, works with any agent framework
• 🌍 Cross-platform — Linux, macOS, Windows (advanced Linux hardening optional)
• 📊 Observability — OpenTelemetry traces, Prometheus-compatible metrics

Development

# Clone
git clone https://github.com/akios-ai/EnforceCore.git
cd EnforceCore

# Setup
python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"

# Test
pytest --cov=enforcecore

# Lint
ruff check . && ruff format --check .

Current stats: 2324 tests · 97% coverage · 0 lint errors

Acknowledgements

EnforceCore builds on a foundation of prior work in computer science and AI safety:

• Runtime Verification — Leucker & Schallhart (2009), Havelund & Goldberg (2005)
• Reference Monitors — Anderson (1972) for the tamperproof, always-invoked enforcement model
• Information Flow Control — Sabelfeld & Myers (2003) for the PII boundary model
• Audit Integrity — Merkle (1987), Crosby & Wallach (2009) for hash-chained tamper evidence
• Agent Containment — Armstrong et al. (2012), Babcock et al. (2016) for the containment framing
• Evaluation Methodology — Prof. Valérie Viet Triem Tong (CentraleSupélec, IRISA/PIRAT) for feedback on adversarial evaluation strategies and containment testing
• Microsoft Presidio — for design inspiration on PII detection patterns
• EU AI Act (2024) — Articles 9, 13, 14, 15 directly shaped the design

See CONTRIBUTORS.md and docs/related-work.md for full citations.

Legal

EnforceCore is provided "as is", without warranty of any kind. See DISCLAIMER.md for full legal terms.

EnforceCore is a technical tool, not a compliance certification. Using EnforceCore does not guarantee regulatory compliance. Always consult qualified legal counsel for compliance requirements.

License

Apache 2.0 — free for open-source and commercial use.

Copyright 2025–2026 AKIOUD AI, SAS. See LICENSE for details.