Governance for AI Agents

Validate cost, safety, and access before your agent deploys. Sits in your CI/CD pipeline. Zero infrastructure.

$ release-gate run governance.yaml

🚪 release-gate: Governance Validation
================================================================================

CHECK                    STATUS   IMPACT
──────────────────────────────────────
ACTION_BUDGET            ✓ PASS   —
BUDGET_SIMULATION        ✓ PASS   —
FALLBACK_DECLARED        ✓ PASS   —
IDENTITY_BOUNDARY        ✓ PASS   —
INPUT_CONTRACT           ✓ PASS   —

✅ FINAL DECISION: PASS
All checks passed. Safe to deploy.
================================================================================ 

The 5 Governance Checks

💵 ACTION_BUDGET

Prevents cost explosions. Set max daily cost and block deployment if exceeded.

🎯 BUDGET_SIMULATION

Project costs realistically. Accounts for retries, caching, spiky usage. Works with 10+ models.

🛑 FALLBACK_DECLARED

Ensure safety measures. Require fallback mode, kill switch, team owner, and runbook.

🔑 IDENTITY_BOUNDARY

Enforce access control. Require authentication, rate limiting, and data isolation.

📋 INPUT_CONTRACT

Validate schemas. Define required inputs and validate against samples.

Why This Matters

AI agents can cost thousands per day and fail in production. release-gate sits between tests and deployment to catch problems early: runaway costs, missing safety measures, and access control gaps.

See It In Action

All Checks Pass: Deployment Approved

$ release-gate run governance.yaml
================================================================================
🚪 release-gate: Governance Validation
================================================================================
CHECK STATUS IMPACT
────────────────────────────────────────
ACTION_BUDGET ✓ PASS —
BUDGET_SIMULATION ✓ PASS —
FALLBACK_DECLARED ✓ PASS —
IDENTITY_BOUNDARY ✓ PASS —
INPUT_CONTRACT ✓ PASS —
────────────────────────────────────────
✅ FINAL DECISION: PASS
All checks passed. Safe to deploy.
💰 BUDGET SIMULATION:
Daily Cost: $12.50 / Budget: $100.00 / Safety: 8.00x
================================================================================

Critical Failures: Deployment Blocked

$ release-gate run governance.yaml
================================================================================
🚪 release-gate: Governance Validation
================================================================================
CHECK STATUS IMPACT
────────────────────────────────────────
ACTION_BUDGET ✗ FAIL CRITICAL
BUDGET_SIMULATION ✗ FAIL CRITICAL
FALLBACK_DECLARED ✗ FAIL CRITICAL
IDENTITY_BOUNDARY ✗ FAIL CRITICAL
INPUT_CONTRACT ✓ PASS —
────────────────────────────────────────
❌ FINAL DECISION: FAIL
Deployment blocked. Fix critical issues first.
❌ BUDGET_SIMULATION: Daily cost $600 exceeds $50 budget
❌ FALLBACK_DECLARED: Missing fallback mode and runbook
❌ IDENTITY_BOUNDARY: Authentication not required
================================================================================

Warnings: Needs Review

$ release-gate run governance.yaml
================================================================================
🚪 release-gate: Governance Validation
================================================================================
CHECK STATUS IMPACT
────────────────────────────────────────
ACTION_BUDGET ✗ FAIL CRITICAL
BUDGET_SIMULATION ⚠ WARN HIGH
FALLBACK_DECLARED ✓ PASS —
IDENTITY_BOUNDARY ⚠ WARN HIGH
INPUT_CONTRACT ✓ PASS —
────────────────────────────────────────
❌ FINAL DECISION: FAIL
Critical check failed. Budget must be adjusted.
⚠️ WARNINGS: Non-critical checks need review
Budget using 85% of daily limit (tight margin)
Rate limiting not configured
================================================================================

Where It Sits: The Deployment Pipeline

Development → Testing → release-gate ← [DECISION] → Deployment → Production
                              ↓
                    ✅ All checks pass
                    ⚠️ Warnings (review)
                    ❌ Fails (fix first)

release-gate sits in your CI/CD pipeline between tests and deployment. It's the governance gate that decides: "Is this safe to deploy?"

How It Works

# In your CI/CD pipeline (.github/workflows, .gitlab-ci.yml, Jenkinsfile) 1. Run tests (your existing test suite) 2. Run release-gate checks - release-gate run governance.yaml - If exit code 1: FAIL (block deployment) - If exit code 10: WARN (needs approval) - If exit code 0: PASS (deploy) 3. Deploy to production (only if pass/approved)

Quick Setup

# One command to set it all up pip install release-gate release-gate init # Answers 6 questions, generates: # - governance.yaml (your configuration) # - .github/workflows/release-gate.yml (or .gitlab-ci.yml / Jenkinsfile) # - GOVERNANCE.md (documentation) # Commit and push - you're done! git push

For Enterprise Teams

How Enterprises Use release-gate

Sit release-gate in your deployment pipeline to enforce governance across all AI agent deployments. Define policies by team, environment, or risk level.

Common Enterprise Scenarios

Cost Control at Scale

Enforce per-agent daily budgets across all teams. Prevent runaway costs from affecting other projects.

Compliance & Audit

Ensure every agent has documented fallbacks, runbooks, and ownership. Export governance evidence for audits.

Team Autonomy

Let teams self-serve with flexible policies. Critical checks block, non-critical checks warn.

Zero Infrastructure

Runs in CI/CD. No backend, no dashboards, no user management. Pure governance in code.

Enterprise Example: Multi-Team Policy

# Production: Strict policy: fail_on: - ACTION_BUDGET - BUDGET_SIMULATION - FALLBACK_DECLARED - IDENTITY_BOUNDARY # Development: Flexible policy: fail_on: - ACTION_BUDGET warn_on: - FALLBACK_DECLARED - IDENTITY_BOUNDARY

What's Coming

Current

  • 5 governance checks
  • Budget simulation (10+ models)
  • Policy engine
  • Multi-platform CI/CD
  • Interactive setup wizard

Next (v0.5)

  • Action scope (allowed tools)
  • Ownership enforcement
  • Deployment fingerprinting
  • GitHub PR integration

Future (v0.6+)

  • Constraint engine
  • Proof mode (verification)
  • Enterprise dashboards
  • Policy packs (templates)

Get Started Now

3 Commands

pip install release-gate release-gate init git push

The init command asks 6 questions and generates your complete governance setup. Takes 5 minutes.