Verified block
Matched tested policy condition: regulated data cannot leave the approved destination set.
blocked before simulated executionOpen sourcePythonApache-2.0
Composable action governance for high-risk agent deployments
The policy gate for AI agent actions.
Govern declared AI agent actions before a side effect occurs. 5D applies versioned deterministic policy at the action boundary, with optional semantic evidence for context-sensitive cases.
When the host supplies the required action identity, routes every relevant path through the gate, and records the outcome, 5D's versioned decision records can help reconstruct what was evaluated and why. The host still owns identity validation, path coverage, execution, recovery, and any legal or assurance conclusion.
quickstart.py
$ pip install fivedrisk
from fivedrisk.hooks import gate
@gate(
tool_name="write_to_database",
autonomy_context=2,
)
async def write_record(table, data):
...
# GREEN or YELLOW → execute
# ORANGE → hold for host-owned review
# RED → blockDecisions in practice
Police the actions before they execute.
AI check + human review
Policy selected explicit human review. The simulated reviewer recorded acceptance; policy then resolved the declared review branch to PERMIT.
simulated permit · no external actionRule-based permit
The tool, target, purpose, and authority matched an explicit policy rule.
simulated permit · no external actionUse cases
Start with the action path you need to govern.
Deterministic red lines
Block prohibited actions before execution
Apply deterministic red lines before a supported tool path runs, and route other high-impact actions according to policy.
Explore the path ↗ Approved data boundariesKeep sensitive data inside approved boundaries
Evaluate declared data class, destination, and purpose before an external transfer.
Explore the path ↗ Selective human reviewFocus human review on policy-selected actions
Resolve explicit rules in policy and hold only the actions your policy routes for an authorised decision.
Explore the path ↗ Runtime recordsKeep reconstructable action records
Preserve the versioned policy decision, evidence, review, execution attempt, and outcome state for declared governed actions.
Explore the path ↗Adjustable assurance
One authority boundary. Optional assurance layers.
Layer only what the risk path needs. The deterministic policy remains the permission authority. Optional observers add evidence; a policy-selected HITL step provides final approval.
Deterministic core
Applies declared prohibitions, thresholds, and routing policy to normalized action context.
Jev observer
Adds: typed semantic evidence for contextual risk signals.
Contextual LLM
Adds: host-selected review when intent cannot be reduced to fixed rules.
Human-in-the-loop
Adds: final approval by an authorised human before the host may execute a policy-held action.
Fail-closed rule: observer evidence can tighten or hold a decision, but cannot clear an explicit block. When a required observer is missing, malformed, or timed out, the action is held or blocked according to policy. When policy requires HITL, missing or declined human approval keeps the action held or blocked.
Throughput economics
Route only the actions that need an observer.
Use deterministic policy for declared action paths, then reserve optional semantic evidence or human review for the cases your policy selects.
Tool, target, purpose, principal, and context enter one declared contract.
Versioned rules resolve declared inputs on documented integration paths.
Observer evidence can tighten or hold. It cannot clear an explicit block.
Illustrative workload model
Change the declared assumptions.
Declared assumptions, not measured 5D performance.
365-day illustrative year. Currency is a display/input unit; no exchange-rate conversion is applied.
Deterministic-only actions / day6,500
Observer- or review-routed actions / day3,500
Estimated routed observer spend / year€6,387.50
One collaboration layer
Five owners, one versioned action contract.
Policy intent, implementation, threat review, human disposition, and reconstructable evidence stay connected without transferring organisational accountability to a model.
Start from public primitives: inspectable policy evaluation, verdicts, documented adapters and gateways, and evidence records. The support matrix states what version 0.7.0 verifies and what the host still owns.
Routing share depends on your policy and traffic.
Observer cost is user-supplied; it is not a 5D price or forecast.
Estimated variable observer spend excludes deterministic infrastructure, human review, retries, and other deployment costs.
Model cost and latency vary with provider, model, caching, concurrency, and deployment design.
Normative integration contract
From Proposal to Action.
Normalize
Describe the tool, target, data, identity, and autonomy context.
Apply policy
Run hard prohibitions first, then evaluate the five action-risk dimensions.
Observe and resolve
Add optional semantic evidence, then permit, hold, or block. Observers cannot clear an explicit block.
Act and record
The host executes or refuses, while disposition, review, and outcome remain separate.
No single package entry point implements every step. The integration support matrix shows what the tested core handles, what needs additional wiring, and what remains the host application's responsibility.
Stable release · 0.7.0
Add the gate to a supported tool-call path.
pip install fivedrisk Implementation accelerator
Set up 5D with your coding agent.
The 5D setup skill helps a coding agent inspect an existing project, scaffold policy, wire a supported path, and run the verification checklist. It produces a reviewable integration; it is not proof that the surrounding deployment is secure.
Five dimensions · one action
Five questions before an agent action crosses the boundary.
5D provides an AI action-risk score from five independently inspectable dimensions. Each runs from lower to higher risk on the same 0 to 4 scale; the score informs policy rather than claiming confidence in the agent's reasoning.
See why these five dimensionsData sensitivity
What information the action touches.
Public → secretsTool privilege
How much power the invoked tool holds.
Read-only → destructiveReversibility
Whether the effect can be recovered.
Easy to undo → irreversibleExternal impact
How far the action can reach.
Local → untrusted externalAutonomy context
How far the action sits from a person.
User-direct → autonomousWhy 5D exists
Autonomy needed a security boundary.
5D began as the security layer inside a personal agentic system where useful autonomy needed a deterministic boundary around dangerous actions.
Read how 5D beganWho needs AI runtime governance
One authority boundary. Four operational questions.
Resources
Build it, inspect it, understand why it matters.
GuidesAll guides ↗
Place authority before executionWhere does 5D sit in an agent execution path, and what does it decide?Keep retries and unknown outcomes visibleHow should an agent runtime record retries and uncertain downstream outcomes?Reconstruct and challenge a decisionWhat evidence makes an action-level governance decision reconstructable and contestable?Technical evidence, not certification. 5D records what its declared policy path evaluated and decided; deployment assurance depends on the surrounding system.