ory-antigravity

Ory Agent Security for the Google Antigravity SDK.

Authorizes every tool call against Ory Permissions via Antigravity's hook system, traces invocations, and propagates user → agent → sub-agent identity — built on ory-argus.

pip install ory-antigravity

from google.antigravity import Agent, LocalAgentConfig
from ory_antigravity import ory_hooks

config = LocalAgentConfig(hooks=ory_hooks(), ...)
agent = Agent(config)

ory_hooks() returns three hooks ready to drop into config.hooks: OnSessionStartHook (auth gates), PreToolCallDecideHook (authorize), and PostToolCallHook (trace). Building your own HookRunner? The same object exposes them by name: ory_hooks().pre_tool_call_decide, .post_tool_call, .on_session_start.

In enforce mode (ORY_PERMISSION_MODE=enforce) a denied tool is aborted — the decide hook returns HookResult(allow=False) and Antigravity hands the model the denial instead of running the tool. In observe mode (default) the tool runs and a permission.observe_deny span is recorded. The ask_question builtin is treated as a user-interaction primitive (never gated); when the model delegates via start_subagent, a sub-agent identity and agent→subagent delegation are recorded.

Antigravity decide hooks fail closed (a raising hook aborts the tool), so this integration owns fail-open itself: a network or rate-limit error on the permission check resolves to allow, and an Ory outage never hard-blocks the agent.

Credentials come from the shared ~/.config/ory-agent-plugins/config.json, so a login from any Ory harness or ory-argus login is reused automatically. See docs/sdk-integrations.md.