AI Agent Production Guardrails & CI Evaluation Starter Kit
A local example for checking AI Agent tool calls before execution. It covers allowlists, selected path arguments and budgets; full schema checks require dependencies. Adapt and test the real executor before using it in production.
Python 3.10–3.12 passed the v0.2.0 hosted CI matrix; this does not validate your integration.
Local Quickstart
Pinned to published Starter tag v0.2.0. The demo uses the Python standard library; full verification needs dependencies. Neither mode calls a paid model API.
# Clone the repository & navigate to starter
git clone https://github.com/bartsaiconsulting/agent-production-starter.git
cd agent-production-starter
git checkout v0.2.0
python3 --version
# Dependency-free checks; Schema/Pydantic/DeepEval are reported as skipped
python3 run_tests.py --demo
# Full verification requires the listed dependencies
python3 -m pip install -r requirements-core.txt
python3 run_tests.py --full
# Run the interception example
PYTHONPATH=. python3 examples/guard_demo.py
DETERMINISTIC ARCHITECTURE
Four Local Engineering Checks
These example checks run before a tool call. Your application must route every call through them and separately enforce runtime isolation and business authorization.
Step Ceilings & Infinite Loop Detection
Enforces hard ceilings on maximum tool calls per session (e.g. 10 steps) and tracks cumulative token burn. Computes SHA256 argument hashes to trip a circuit breaker if the agent repeats identical calls 3 times consecutively.
Least-Privilege Scoping & Anti-Traversal
Checks a tool allowlist and known path fields, including nested dictionaries and lists. It rejects paths resolving outside the declared root (for example ../../../../etc/passwd). It does not confine the executor, unknown arguments or later symlink changes.
Approval Token Check
Categorizes tools into READ_ONLY, MUTATIVE_WRITE, and DESTRUCTIVE tiers. When approval is required, the guard rejects destructive calls unless the token belongs to a configured set. The sample does not verify signatures, expiry, single use, or binding to a person or action. The application must enforce approval and route every tool call through the guard before execution.
Strict Schema Typing & Anti-Wildcard Mutation
With dependencies installed, validates arguments against JSON Schema and Pydantic models. A separate helper rejects empty WHERE inputs; the application must still enforce its database authorization and query semantics.
How to Wrap Your Agent Loop
Compatible with LangChain, CrewAI, AutoGen, or custom tool-calling agents:
from pathlib import Path
from bartsai_guard import ToolGuard, ToolPermissionLevel, CircuitBreaker
# 1. Configure boundaries and permission tiers
guard = ToolGuard(
allowed_tools={"query_db", "write_file", "drop_table"},
tool_permissions={
"query_db": ToolPermissionLevel.READ_ONLY,
"write_file": ToolPermissionLevel.MUTATIVE_WRITE,
"drop_table": ToolPermissionLevel.DESTRUCTIVE, # Requires 2PC token!
},
sandbox_root=Path("./agent_workspace").resolve(),
require_human_approval_for_destructive=True,
valid_approval_tokens={"user_session_token_xyz"}
)
breaker = CircuitBreaker(max_steps=10, max_cost_usd=0.50)
def safe_tool_executor(tool_name: str, arguments: dict, token: str = None):
# Step A: Enforce step limits and detect infinite loops
breaker.record_step(tool_name, arguments, step_tokens=400, step_cost_usd=0.005)
# Step B: Authorize tool & check recognized path arguments
guard.inspect_and_authorize(tool_name, arguments, approval_token=token)
# Step C: Execute using the validated target and your own isolation controls
return actual_tool_implementation(tool_name, arguments)Taking an Autonomous Agent to Production?
While source-available starter code provides reusable examples, high-consequence enterprise agents still require deployment-specific verification. Explore our 1-week independent Launch Gate Review.