qerexa-langchain

Gate every LangChain agent action through Qerexa runtime trust enforcement.

When an AI agent tries to do something consequential — write to a database, send a payment, deploy code, delete records — this package routes that action through a Qerexa gate first. The gate evaluates policy, optionally requires human approval, and records the decision in a tamper-evident audit chain. The action only runs if the gate allows it.

Built for the EU AI Act Article 14 human-oversight requirement, enforceable August 2026.

Install

pip install qerexa-langchain

Quickstart

from qerexa_langchain import QerexaClient, gated

qerexa = QerexaClient(api_key="sk_live_...")  # or set QEREXA_API_KEY

@gated(action="database.write", client=qerexa)
def write_record(data: str) -> str:
    # This body only executes if Qerexa allows the action.
    return db.insert(data)

If the gate blocks the action, write_record never runs — it raises GateBlockedError. If the action requires human approval, the call blocks until an approver decides (or times out).

Gate an existing LangChain tool

from langchain_core.tools import tool
from qerexa_langchain import QerexaClient, gate_tool

qerexa = QerexaClient(api_key="sk_live_...")

@tool
def transfer_funds(amount: float, to: str) -> str:
    """Transfer funds to a recipient."""
    return payments.send(amount, to)

# Wrap it — every invocation now passes through the gate.
safe_transfer = gate_tool(transfer_funds, client=qerexa, action="payment.transfer")

agent = create_agent(llm, tools=[safe_transfer])

Let the agent reason about a block

By default a block raises. Pass on_block to return a message the agent can read and act on instead:

@gated(
    action="database.delete",
    client=qerexa,
    on_block=lambda err: f"Action blocked by policy: {err.reason}. Ask a human to approve.",
)
def delete_records(query: str) -> str:
    return db.delete(query)

Human-in-the-loop approval

When a Qerexa policy marks an action as requiring approval, the gate holds it and notifies the approver. The call waits until a decision is made:

qerexa = QerexaClient(
    api_key="sk_live_...",
    approval_timeout=600,   # wait up to 10 minutes for a human
    poll_interval=3,
)

@gated(action="production.deploy", client=qerexa)
def deploy(service: str) -> str:
    return k8s.rollout(service)

Set wait_for_approval=False on the decorator to fail fast instead of waiting.

Configuration

The distribution includes a py.typed marker, so type checkers can consume the package's inline type annotations.

Why gate agent actions?

Your IAM knows the agent is authenticated. Your infrastructure runs what it's told. Nothing in between enforces whether a specific action, against a specific target, at a specific moment, is authorized — with proof. An AI agent can fire a thousand actions a minute. Qerexa is the enforcement layer in that gap.

Every gate decision is written to Qerexa's tamper-evident audit chain. Completed human approvals are published into the Merkle transparency ledger and become independently verifiable after the corresponding root is published.

License

MIT