Execution Governance

What each component is licensed under, and what you may do with it.

Pre-execution authorization for AI agent tool calls: allow or deny before execution, fail-closed, with a signed receipt for every decision.

Request → Verify → Allow or Deny → Execute → Proof.

Execution Governance evaluates each action against a policy and returns allow or deny before the action runs, and writes a signed receipt for every decision. The proprietary policy core stays behind an interface: this repository ships a small SDK, a basic local engine, an MCP proxy, and the receipt format. Pre-execution authorization. Fail-closed enforcement. Cryptographic proof on every action.

An agent reads a briefing carrying a prompt injection, obeys it, and tries to POST the contents of .env to an attacker. The gate denies the call before it executes and the receipt chain verifies. That is the real program, unedited:

npm run demo

The GIF is generated from examples/injection-demo/demo.tape with vhs, so it can be regenerated whenever the demo changes rather than drifting into showing output the code no longer produces:

vhs examples/injection-demo/demo.tape

Packages

• @11ai/execution-governance: the SDK. Authorize a call, run it only on allow, verify receipts.
• @11ai/mcp-gate: a stdio MCP proxy. Gate an existing MCP server by changing one line of config.

Quickstart

Install to first deny receipt, and then verify that receipt yourself. Copy this into an empty directory:

mkdir eg-quickstart && cd eg-quickstart
npm init -y && npm pkg set type=module
npm install @11ai/execution-governance
curl -sLO https://raw.githubusercontent.com/11-11AI/execution-governance/main/examples/quickstart/quickstart.mjs
curl -sLO https://raw.githubusercontent.com/11-11AI/execution-governance/main/examples/quickstart/eg-policy.yaml
node quickstart.mjs --key ./eg-signing.key --receipts ./eg-receipts.jsonl

With the starter policy, a secret-bearing outbound POST is denied before fetch runs, a signed receipt is appended, and the run prints the exact command that checks it:

created signing key ./eg-signing.key (private: keep it out of version control)
denied: exfiltration: outbound call carrying secret material
receipt: 01a03bd6-f736-785b-a82d-62363da0273e

verify it yourself:
  npx eg-verify --receipts ./eg-receipts.jsonl --pubkey huCJiiZMYF0Ye7R6099agDYtV8TLOhmqCnv8LewTb7A

Run that command and you get RESULT: VERIFIED. The public key is yours, so it will not be the one above.

--key is the part that matters. Without a stable signing key the SDK generates one per run, warns, and throws it away: the receipts still look fine and can never be verified again, including by you a minute later. The same flag, and the same key file format, is what @11ai/mcp-gate takes.

That is the whole API:

import { createGate } from "@11ai/execution-governance";

const gate = createGate({ policy: "./eg-policy.yaml", signingKey });

const result = await gate.govern({ sessionId: "s1", tool: "http.post", args: { url, body } }, () =>
  fetch(url, { method: "POST", body }),
);

govern runs the callback only on allow, and throws DeniedError on deny. See examples/quickstart for the file this snippet came from.

Gate an MCP server with one line

Change the server command in your MCP client config to wrap it:

{
  "command": "npx",
  "args": ["-y", "@11ai/mcp-gate", "--policy", "eg-policy.yaml", "--", "node", "their-server.js"]
}

initialize, tools/list, resources, and notifications pass through untouched. A tools/call is gated. A denied call is answered to the client with a JSON-RPC error and is never forwarded to the server.

Demo

The demo runs from a clone of this repository, not from the installed package. npm run demo is a script in this repo; installing the package does not provide it.

git clone https://github.com/11-11AI/execution-governance
cd execution-governance
npm install
npm run demo

An agent reads a briefing that carries a prompt injection telling it to exfiltrate .env. The agent obeys. The gate denies the exfiltration before it runs, and prints a verified receipt chain. No API keys, no network.

A receipt

{
  "receiptId": "019f7833-fddc-7a2b-8070-fa732536e98b",
  "ts": "2026-07-19T02:30:00.000Z",
  "sessionId": "s1",
  "tool": "http.post",
  "argsHash": "...",
  "decision": "deny",
  "reason": "exfiltration: outbound call carrying secret material",
  "policyVersion": "starter-1",
  "prevReceiptHash": "genesis",
  "kid": "4a45b7f302b1db21",
  "sig": "..."
}

Each receipt is canonical JSON, sha3-512 hashed, Ed25519 signed, and chained. Verify a file with:

eg-verify --receipts eg-receipts.jsonl --pubkey <base64url public key>

Or verify a receipt in your browser: one self-contained HTML file that recomputes every hash, checks every signature and walks the chain locally. Save it and it works with the network off. It ships a signed example and a tampered one, and a test asserts it returns the same verdict as eg-verify on the same bytes.

Fail-closed

Any error, timeout, unreachable engine, malformed policy, or missing decision results in deny. There is no fail-open path. A denied call in a chain absorbs: dependent calls downstream are denied without calling the engine.

Measured

• Conformance properties checked in CI: absorption, monotone evidence growth, non-commutativity.

• 26 of 26 adversarial vectors denied under the starter policy starter-1, reproducible in CI. Every vector, and the reason the engine returned for it, is in docs/VECTORS.md.

Docs

• docs/RECEIPTS.md: the exact receipt format and verification.
• docs/POLICY.md: the policy schema and the canonical starter policy.
• docs/VECTORS.md: every adversarial vector and the decision it gets. Generated.
• docs/verify/index.html: the browser verifier. Offline, no build step, no server. Hosted at https://11-11ai.github.io/execution-governance/verify/.
• RELEASING.md: how to publish.

The rest of the project

This repository is the SDK and MCP proxy. It and the rest of the open project live in the 11-11AI organisation. If you arrived here from npm, these are the parts you cannot see from this repo:

• Doctrine — the eight principles the design follows, each with its verification path.
• verify-11ai-proof — check the live control plane's signed governance decisions on your own machine, no API key. Verifies Ed25519 locally; post-quantum requires liboqs-python and is reported as skipped otherwise.
• Lineage verifier — RFC-EG-0010 execution lineage, dual-hash chained, with a reference verifier.
• Governance profiles — machine-readable conformance profiles.
• Live proof: https://control.11aiblockchain.com/proof (the evidence viewer) and https://11aiblockchain.com/proof (the overview). These are two different pages on two different hosts; the first serves the live EA-11 evidence record.

Research

• Research corpus: Zenodo, 11/11 AI community.
• Category paper: Execution Governance: A Proposed Infrastructure Category, DOI 10.5281/zenodo.20453136.

Disclaimer

This software is provided under the Apache License 2.0, on an AS IS basis, without warranties or conditions of any kind. See the LICENSE for the full disclaimer of warranty and limitation of liability.

Execution Governance enforces the policy you configure. It is one control, not a complete security solution, and it does not guarantee that every unsafe action is denied or that every safe action is allowed. You are responsible for your policy, your deployment, your signing keys, and the outcomes on your own systems. To the extent permitted by law, the authors and copyright holders are not liable for any harm to your systems, data, or operations, including missed denials, wrongful denials, downtime, or data loss, arising from the use of this software.

License

Apache-2.0. See LICENSE and NOTICE. See LICENSING.md for the per-component boundary between what is open and what is commercial.