Compile
Plain-English governance becomes a typed policy suggestion.
Governance and immunity for tool-using agents
The safety layer that learns from every correction.
Covenant intercepts tool calls deterministically, records hash-linked receipts, and proves a human-approved policy patch prevents the same mistake without regressions.
DETERMINISTIC DECISIONBLOCK
tool send_email
derived.external_domains [partnerco.example]
derived.contains_customer_data true
matched_rule block-customer-data-external
The leak never reaches the sandbox tool.
Intercept
A pure engine decides every proposed tool call before execution.
Prove
Hash-linked receipts preserve a tamper-evident export of the run.
Immunize
Human corrections become regression evals and approval-gated patches.
Run control room
→Launch the seeded task and watch every decision arrive live.
Receipt chain
→Inspect, verify, and export the current run's evidence.
Immunity lab
→Correct a decision and prove the patch before activation.
Prototype safety layer. In-process enforcement is bypassable by code that does not route through it and is not proof that agents are universally safe. Receipts are tamper-evident within their export, not cryptographic signatures.