EnforceCore

Lightweight, open-source runtime enforcement for any Python-based AI agent.

Current release: v1.0.1 (stable) — Production-ready, first stable API, 1,510 tests, 22 formal invariants. Available on PyPI.

EnforceCore is a modular enforcement framework that intercepts every external call your agent makes — tool calls, API requests, file access — and applies mandatory policy checks, PII redaction, secret scanning, content rule enforcement, rate limiting, resource limits, and tamper-proof audit logging.

It operates at the runtime call boundary — the only layer that cannot be jailbroken, bypassed, or prompt-injected away. The @enforce() decorator acts as a runtime monitor in the tradition of runtime verification: an observer that intercepts system events, evaluates them against a specification, and emits a verdict before the action is allowed to proceed.

Why EnforceCore

The AI agent ecosystem is racing to build more capable autonomous systems. But almost nobody is building the control layer.

Most "safety" solutions are prompt-level guardrails — suggestions to the LLM that can be bypassed, ignored, or jailbroken. They operate at the wrong layer.

EnforceCore enforces at the code boundary. Policies are mandatory, not advisory. If a call violates policy, it is blocked — before it ever executes.

Enforce, don't suggest

Policies are mandatory. A denied tool call never executes. There is no "override" prompt.

Framework-agnostic

Works with LangGraph, CrewAI, AutoGen, or plain Python. No lock-in.

Verifiable

Every enforced call produces a SHA-256 Merkle-chained audit entry. The full trail is tamper-proof and cryptographically verifiable. 22 formal properties are verified via Hypothesis property-based testing on every CI run.

Lightweight

~0.056 ms E2E overhead (P50). Negligible compared to tool call latency (100 ms–10 s).

EnforceCore vs. OS-level security: EnforceCore operates at the application semantic layer — it understands tool calls, PII, and cost budgets. It does not replace SELinux, AppArmor, seccomp, or container sandboxing. These are complementary — use both for defense-in-depth.

Core Components

Install

pip install enforcecore

Python 3.11+ required. No heavy dependencies — Pydantic v2, PyYAML, structlog, cryptography.

Note: EnforceCore is currently in beta (v1.0.0b5). The 30-symbol public API is frozen — no additions or removals until v2.0.0. All 110 original symbols remain importable for backwards compatibility, but the stable contract covers the 30 Tier 1 symbols.

Get Started

from enforcecore import enforce

@enforce(policy="policy.yaml")
async def search_web(query: str) -> str:
    return await api.search(query)

# If "search_web" is not in allowed_tools -> blocked. Period.
# PII in query -> auto-redacted before the call.
# Every call -> cryptographic audit entry.

See the Quick Start guide for a full walkthrough — policy setup, lifecycle hooks, audit verification, and tamper-evidence hardening in under 5 minutes.

Who is this for?

• Agent developers who need production-grade safety without rewriting their stack
• Enterprises deploying AI agents in regulated environments (finance, healthcare, legal)
• Researchers studying runtime verification, sandboxing, and formal guarantees for agents
• Teams preparing for EU AI Act compliance requirements

Verified by Design

EnforceCore backs its guarantees with measurable evidence:

• 1,510 tests, 95% coverage, 22 formal invariants (Hypothesis property-based testing)
• Formal threat model — 4 adversary types, 4 security properties, tamper-proof audit trails with OS-enforced append-only + witness backends
• 20 adversarial scenarios across 10 threat categories, 15 performance benchmarks
• 0.056 ms full E2E overhead (P50) — negligible compared to tool call latency

See the Architecture page for formal invariants, threat model, and defense-in-depth. See the Evaluation Suite for reproducible adversarial benchmarks.

For Researchers

EnforceCore applies established computer science principles — runtime verification, reference monitors, information-flow control — to the novel problem of AI agent safety. We welcome academic collaboration and feedback.

The Architecture page documents the formal invariants (22 Hypothesis properties with $\forall$ notation), threat model (4 adversary types, 4 security properties), and defense-in-depth architecture. The Evaluation Suite provides reproducible adversarial benchmarks.

Prior work that informed the design:

• Runtime Verification — Leucker & Schallhart (2009), Havelund & Goldberg (2005)
• Reference Monitors — Anderson (1972)
• Information Flow Control — Sabelfeld & Myers (2003)
• Audit Integrity — Merkle (1987), Crosby & Wallach (2009)
• Tamper-Evidence — Wallach (2026, design feedback on append-only + witness mitigations)
• Agent Containment — Armstrong et al. (2012), Babcock et al. (2016)

Citation

@software{enforcecore2026,
  title  = {EnforceCore: Runtime Enforcement Layer for Agentic AI Systems},
  author = {{AKIOUD AI}},
  year   = {2026},
  url    = {https://github.com/akios-ai/EnforceCore},
  license = {Apache-2.0}
}

Open Source

EnforceCore is Apache 2.0 licensed. No hidden commercial agenda in the core.

• GitHub Repository
• Architecture
• API Reference
• Quick Start
• Evaluation Suite
• Roadmap

Legal

EnforceCore is provided "as is", without warranty of any kind, express or implied. It is a technical enforcement tool — not a compliance certification. Using EnforceCore does not guarantee regulatory compliance with any standard or law. See DISCLAIMER and LICENSE for full legal terms.