parapetai-agent

In-process governance for AI agent frameworks. Wrap the agent you already have, and every model call and tool call becomes a Cedar policy decision — default-deny, fail-closed, content-free audit.

pip install parapetai-agent

Use it

from parapetai_agent import GovernedAgent as Agent, GovernanceDenied

agent = Agent(
    name="support",
    instructions="Help the customer.",
    tools=[lookup_order],
    agent_id="pa-e3931c464751",
    control_plane_url="https://parapetai.example.com",
    agent_secret="...",
)

try:
    result = await agent.run("Where is order 1234?")
except GovernanceDenied as denied:
    print(denied.reason)

GovernedAgent is a drop-in replacement for agent_framework.Agent. If you build your own middleware chain instead, build_middleware() returns the same governance as a plain middleware you can pass to middleware=[...].

Policy comes from a signed bundle the SDK pulls from the control plane and caches locally; decisions are pushed back as content-free audit records. Without a control plane, point policy_dir= at local Cedar files.

Identity

Governance decisions are made about a caller, not just an agent. Bind one:

from parapetai_agent import set_identity, use_identity

set_identity("alice", claims={"oid": "..."}, roles=["OrderViewer"])
with use_identity("alice"):
    await agent.run(...)

In a web app, install parapetai-agent[web] and add IdentityMiddleware, which lifts the identity off the incoming request instead.

Extras

The base install never imports a web framework or an agent framework, so a CLI script or background worker can depend on it without pulling either in.

Invariants

These are security properties, not defaults you can tune away:

• Fail closed. An unparsed payload, an evaluation error, or a missing policy denies. No exception path becomes an implicit allow.
• Cedar is default-deny. No matching permit is a Deny; forbid always beats permit.
• A bad bundle never empties the policy set. Reload keeps the previous policies on failure.
• Prompt content is never logged unless you explicitly opt in. The decision audit record is content-free by construction, not by configuration.

Links

• Source: https://github.com/autonomyproof/parapetai-platform
• Issues: https://github.com/autonomyproof/parapetai-platform/issues

MIT licensed.