Agent governance, enforced
Ship agents that can't cross the lines you draw
Decorum compiles your conduct policy into the prompt and a mechanical floor — deterministic checks on input, tool calls, and output that hold even when the model doesn't listen.
# deploy binding — one policy source
name: support-concierge
role: customer support
conduct:
- conduct/info-not-advice
- conduct/never-reveal-directives
persona: persona/concierge
fail_posture: closed
output: { mode: buffered }What the engine guarantees
Enforced, not requested
One policy source compiles to both the words the model reads and a mechanical floor. Enforced rules are deterministic detectors — blocked means blocked.
Fails closed
A floor error blocks. A regulated flag forces buffered delivery and fail-closed posture. The engine never degrades open.
No model in the loop
The enforcement layer makes no LLM calls and touches no network — no new inference cost, no latency lottery, nothing extra to jailbreak.
Tighten-only directives
Operators and tenants add restrictions at runtime — per agent, per tenant. Nothing at a lower tier can loosen a higher one.
Content-free audit
Every verdict is logged with rule ids, stages, and hashes — never the user's text. Compliance evidence without a data-retention problem.
Yours to run
Install the library, wire five hooks into your agent loop — or use a shipped adapter. Your infrastructure, your data. There is no server.
Where it stands today
production deployments enforcing conduct today
tests in the engine's suite, plus an adversarial security audit
LLM calls made by the enforcement layer