The problem with most approaches to AI agent governance is that they operate on the wrong side of the moment. They describe what should happen, monitor what did happen, or filter the text surrounding an action. None of them sit in the action path and intervene before the consequence is already in motion.
Ethosure takes a different position – literally. The enforcement layer intercepts an agent action before it executes, evaluates it against defined policy, and returns a deterministic decision. The agent does not proceed until the decision is made. If the action is compliant, it proceeds. If it is not, it does not. The record of that decision is written regardless of the outcome.
This design choice – control in the path, not observation from the side – is what makes Ethosure a guardian rather than a monitor.
What “deterministic” means and why it matters
A deterministic enforcement decision means: given the same action, the same policy, and the same context, the system always produces the same decision. It does not vary based on phrasing. It does not produce a slightly different answer depending on the day. It is not influenced by what the model thinks the intention was. It evaluates facts against rules and returns a result.
This is how financial transaction controls work. A payment size limit does not ask whether the transaction “seems” legitimate based on its description – it checks whether the amount exceeds the threshold and returns yes or no. That predictability makes it auditable and makes it a control rather than a guideline.
Ethosure’s enforcement layer is built on CEL (Common Expression Language), a deterministic policy evaluation engine. CEL is pure – it does not learn, drift, or adapt. It evaluates policy over facts that a deterministic Go-based collector (using Tree-sitter for code analysis) has assembled. Probabilistic or embedding-based approaches are explicitly excluded from the enforcement path. Embeddings exist in the system for code-intelligence search – helping agents find relevant prior work – but they are never the source of a control decision.
The four outcomes
Every agent action that enters the enforcement layer resolves to one of four dispositions:
- Allow. The action passes policy and proceeds to execution. The approval is recorded.
- Transform. The action can be made compliant through a defined rewrite – removing a hardcoded credential, applying a required license header, constraining a command to its declared scope. The agent receives the transformed version and continues. Both the original and the transformation are recorded.
- Escalate. The action requires a human decision before it proceeds. A reviewer is notified; the agent waits. The outcome of the human review is recorded.
- Block. The action violates policy and is denied. The agent receives the decision and the policy rule that produced it. The block is recorded.
These four outcomes are exhaustive. The system is fail-closed: if evaluation is indeterminate, if input is malformed, or if a bypass attempt is detected, the default disposition is Block. Bypass attempts – through alternative Git paths, hook-skip flags, or subprocess indirection – are treated as enforcement failures, not gaps to be handled separately.
Neutral, local-first, and sovereign-ready
One concern that surfaces frequently among enterprise security teams is where enforcement happens. Routing agent actions through a hosted cloud service means every action your agents take is visible to a third party – a significant problem for organizations with data-residency requirements or sensitive intellectual property.
Ethosure is local-first by design. The enforcement layer runs in your environment. There is no required hosted backend. Policy bundles are compiled locally and distributed within your infrastructure. The evidence ledger lives where you tell it to live.
The underlying coding-ethos project, which holds the OpenSSF Best Practices Silver badge, is deployable in air-gapped and regulated environments. Organizations in financial services, government, and healthcare can run full enforcement capability without sending agent activity data to a third-party cloud.
Ethosure is also model-neutral. The enforcement layer sits between the agent and its actions – not between the agent and its underlying model. It works with any model, any agent framework, and any development environment.
Evidence as a first-class output
The evidence the enforcement layer produces is not a log file. It is a structured, append-only record in SARIF format with policy identifiers, skill references, and remediation metadata attached to every finding.
Every decision is traceable back to the specific policy rule, the action evaluated, the context in which the evaluation ran, and the disposition that resulted. The record cannot be quietly edited after the fact – it is produced in real time, at the moment of decision, as a natural output of the enforcement process.
This distinction matters when a regulator asks for evidence of control. A monitoring log showing what an agent did is different from an enforcement record showing what the governance layer decided – and when. The second is what the EU AI Act’s Article 99 documentation requirements, NIST AI RMF’s evidence functions, and ISO/IEC 42001’s audit trail requirements are designed to receive.
