Home Dashboard GitHub

One runtime governance decision plane + an open policy-as-code SDK — Phase 1 of out-innovating Credo AI

2026-07-20

securitypolicy-engineguardrailsmcptool-call-firewall

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["none"] sdk_methods_updated: ["none (no /v1 route added this phase)"] mcp_tools_updated: ["none (McpGovernor gained an internal PolicyEngine consult; no new tool)"] ---

What We Built

Phase 1 of BrainstormRouter's push to out-innovate Credo AI in AI governance. The competitive thesis: Credo's platform _documents_ what AI systems are supposed to do (a pull-based registry + evidence model that sits beside the ML lifecycle), while BR already sits inline on every request and can _enforce_. This phase sharpened that runtime edge and opened the developer lane Credo abandoned when it archived its Lens OSS project.

Four pieces landed. (1a) The PolicyEngine gained real expressiveness — recursive boolean predicate trees (all / any / not) and numeric operators (gt/gte/lt/lte), so a pack can express actual rules instead of flat AND lists, fully backward-compatible with existing conditions[]. (1b) A semantic (LLM-judge) outbound governance tier now catches violations that keyword heuristics miss (e.g. "never disparage a competitor" phrased without those words), running _off_ the token-flush path so it adds zero forwarding latency. (1c) One unified decision plane: the tool-call firewall and the MCP governor now consult the same tenant PolicyEngine that gates completions, so a single pack governs completions, tool calls, and MCP alike. (1d) The Open Governance Pack (OGP) format plus a zero-dependency evaluator SDK in both TypeScript and Python, with a Cedar import adapter so teams on AWS Cedar or Microsoft's Agent Governance Toolkit can migrate in.

Why It Matters

Governance buyers pay for enforcement and evidence, not documents. By making the policy pack an _executable_ artifact — the same rules you evaluate in CI or a notebook are the rules the gateway enforces on live traffic — BR collapses the gap between "governance policy" and "production behavior" that documentation-only tools structurally cannot close. The OSS SDK gives developers a portable, runnable governance format to adopt bottom-up, seeding the enterprise motion.

How It Works

Every runtime surface now speaks one decision vocabulary (allow, deny, log, warn, require_approval, mask, substitute, downgrade, quarantine, sever) over one PolicyContext (with tool and inter-agent dimensions). The tool-call firewall folds a pack decision into its verdict via priority-max escalation (it can only tighten, never loosen); McpGovernor consults the pack before its local allowlist. The semantic tier mirrors the proven inbound injection judge — router-injected, tenant-scoped SHA-256 verdict cache, 500ms timeout, fail-open — and gates the _next_ streaming window rather than blocking the current one.

import { loadPack, packToRuleset, evaluate } from "@brainstormrouter/governance-sdk";
const ruleset = packToRuleset(loadPack(fs.readFileSync("prod-safety.ogp.json", "utf8")));
evaluate(ruleset, { action: "tool.execute", toolName: "shell" }).decision; // "deny"

The Numbers

  • Inline sync enforcement budget: p99 < 3ms (heuristics + PolicyEngine + regex, all pure/in-memory).
  • Semantic tier: 500ms hard timeout, fail-open, never on the flush path.
  • 2 open-source SDKs (TS + Python), zero runtime dependencies each.
  • +35 unit tests across the phase; full suite green at 9,112 passing.

Competitive Edge

Credo AI documents intended behavior; BR decides what's allowed inline on every request and now emits it through one enforcement plane spanning completions, tools, and MCP. Against Microsoft's runtime Agent Governance Toolkit (Rego/Cedar, attribute-only), BR matches structured-decision latency and adds a _semantic_ tier those engines cannot express — while interoperating via the Cedar import adapter so their users migrate in rather than being locked out.

Lockstep Checklist

> No new /v1 route landed this phase (pack-management routes are Phase 4), so > the SDK/MCP route lockstep does not trigger. The two new packages/* are > standalone OSS governance SDKs, not the platform client SDKs.

  • [x] API Routes: none added this phase.
  • [x] TS SDK: n/a for platform client SDK; new standalone @brainstormrouter/governance-sdk shipped + tested.
  • [x] Python SDK: n/a for platform client SDK; new standalone brainstorm-governance-sdk shipped + tested.
  • [x] MCP Schemas: no new tool; McpGovernor gained an internal PolicyEngine consult.
  • [ ] Master Record: to update when Phase 2 (evidence artifacts) lands the governance surface.

Follow-ups

  • McpGovernor live per-tenant wiring (its checkPolicy has no tenantId in

signature); the injection capability is in place and unit-tested.

  • Rego import adapter (Cedar shipped; Rego is the next interop target).
  • Phase 2: unified Governance Artifact + coverage-as-metric.