agt-governance

---
name: agt-governance
description: Behavioral governance for OpenClaw agents via AGT — tool-level policy, inter-agent trust, audit logging.
metadata: {"openclaw": {"requires": {"env": ["AGT_GOVERNANCE_ENABLED"]}, "primaryEnv": "AGT_GOVERNANCE_ENABLED"}}
---

# AGT Governance — Tool Policy, Trust, and Audit

You are running with AGT (Agent Governance Toolkit) governance enabled. This means every tool call you make is evaluated against a policy before execution.

## What governance does

- **Tool-level policy**: Before you execute a shell command or tool, AGT checks if it's allowed. Dangerous operations (rm -rf, chmod 777, dd) are blocked. Destructive operations (rm, delete) require human approval.
- **Trust scoring**: When communicating with other agents, trust scores (0-1000) determine what actions are allowed. Higher trust = more capabilities.
- **Audit logging**: Every action you take is recorded in a tamper-evident hash-chain log for compliance.

## What governance does NOT do (kars handles these)

- Network restrictions → kars iptables + NetworkPolicy (kernel-level)
- Filesystem scope → kars read-only rootfs (OS-level)
- Content safety → kars Content Safety API (router-level)
- Token budgets → kars inference router (router-level)
- IMDS blocking → kars iptables UID-based (kernel-level)

## How it works

AGT runs in-process (< 0.1ms overhead per check). The policy is loaded from `$AGT_POLICY_DIR`.

## Inter-agent communication

When sending messages to other agents:
1. Your message is signed with your Ed25519 identity (DID)
2. The target agent's trust score is checked against the threshold
3. If trust is sufficient, the message is delivered
4. Trust scores update based on interaction outcomes

## Trust tiers

| Score | Tier | Capabilities |
|-------|------|-------------|
| 900-1000 | Verified Partner | Full access, elevated privileges |
| 700-899 | Trusted | Standard operations |
| 500-699 | Standard | Default for new agents |
| 300-499 | Probationary | Limited, under observation |
| 0-299 | Untrusted | Read-only or blocked |

## What to do if an action is blocked

If AGT blocks an action, it will tell you why. Common reasons:
- **Shell command not in allowlist**: Use only approved commands (ls, cat, grep, git, python, curl, etc.)
- **Destructive operation**: Requires human approval. The operator will be notified.
- **Rate limit exceeded**: Too many tool calls in a short period. Wait and retry.
- **Trust score too low**: The target agent's trust is below the threshold.

More agent context in Azure/kars

14 other files this repository gives its agents.