Getting Started — AI Runtime Governor

Real-time governance, compliance, and observability for autonomous AI agents.
Evaluate every tool call before execution. Enforce custom policies. Detect multi-step threats. Stay audit-ready.

curl https://api.airg.nov-tia.com/healthz
# → {"status":"ok"}

curl -s -X POST https://api.airg.nov-tia.com/actions/evaluate \
  -H "X-API-Key: airg_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "shell",
    "args": {"command": "rm -rf /"},
    "context": {"agent_id": "my-agent"}
  }' | jq .

{
  "decision": "block",
  "risk_score": 95,
  "explanation": "Destructive filesystem operation",
  "policy_ids": ["shell-dangerous"],
  "execution_trace": [...]
}

# Python
pip install airg-client

# TypeScript / JavaScript
npm install @airg/governor-client

# Java (Maven)
<dependency>
  <groupId>com.airg</groupId>
  <artifactId>airg-client</artifactId>
  <version>0.3.4</version>
</dependency>

Chain analysis runs automatically on every evaluation. No configuration required. Detected patterns appear in the Chain Analysis dashboard tab.

# Login → JWT token
TOKEN=$(curl -s -X POST https://api.airg.nov-tia.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"your-password"}' | jq -r .access_token)

echo $TOKEN

# Rotate your own API key (self-service)
curl -s -X POST https://api.airg.nov-tia.com/auth/me/rotate-key \
  -H "Authorization: Bearer $TOKEN" | jq .

# Returns: {"api_key": "airg_abc123..."}

Module RBAC: SURGE v2 write endpoints (/issue, /checkpoint) and PII scanning require operator+ role. Fingerprint reset (DELETE /fingerprint/agents/:id) requires admin. All module read endpoints are available to any authenticated user.

# As admin, create an operator account
curl -s -X POST https://api.airg.nov-tia.com/auth/users \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"username":"agent-ops","password":"secure-password","role":"operator"}' | jq .

Tip: After your first login, navigate to the API Keys tab in the dashboard to generate an API key for programmatic access. API keys (airg_… prefix) are the recommended authentication method for agent integrations.

import governor_client
from governor_client import evaluate_action, GovernorBlockedError

governor_client.GOVERNOR_URL = "https://api.airg.nov-tia.com"
governor_client.GOVERNOR_API_KEY = "airg_your_key_here"

try:
    decision = evaluate_action("shell", {"command": "ls -la"}, context={
        "agent_id": "my-agent",
        "session_id": "session-123",
        "allowed_tools": ["shell", "http_request", "file_read"],
    })
    print(f"{decision['decision']} — risk {decision['risk_score']}")
except GovernorBlockedError as e:
    print(f"Blocked: {e}")
    # Do NOT execute the tool

import { GovernorClient, GovernorBlockedError } from "@airg/governor-client";

const gov = new GovernorClient({
  baseUrl: "https://api.airg.nov-tia.com",
  apiKey: "airg_your_key_here",
});

try {
  const d = await gov.evaluate("shell", { command: "ls -la" }, {
    agent_id: "my-agent",
    allowed_tools: ["shell", "http_request"],
  });
  console.log(`${d.decision} — risk ${d.risk_score}`);
} catch (err) {
  if (err instanceof GovernorBlockedError) {
    console.error("Blocked:", err.message);
  }
}

GovernorClient gov = new GovernorClient.Builder()
    .baseUrl("https://api.airg.nov-tia.com")
    .apiKey("airg_your_key_here")
    .build();

try {
    GovernorDecision d = gov.evaluate("shell", Map.of("command", "ls -la"));
    System.out.println(d.getDecision() + " — risk " + d.getRiskScore());
} catch (GovernorBlockedError e) {
    System.err.println("Blocked: " + e.getMessage());
}

export GOVERNOR_URL=https://api.airg.nov-tia.com
export GOVERNOR_API_KEY=airg_your_key_here

from governor_client import (
    evaluate_action,
    GovernorBlockedError,
    GovernorReviewRejectedError,
    GovernorReviewExpiredError,
)

try:
    decision = evaluate_action(
        "deploy_contract",
        {"contract": "TokenSwap.sol"},
        context={"agent_id": "defi-agent"},
        review_mode="hold",       # wait for human decision
        hold_timeout=120,          # max 120s
    )
    # If we reach here, the action was approved
    print(f"Approved by {decision.get('review_resolved_by')}")
except GovernorBlockedError:
    print("Blocked by policy")
except GovernorReviewRejectedError as e:
    print(f"Human rejected: {e}")
except GovernorReviewExpiredError as e:
    print(f"Review timed out: {e}")

curl -s -X POST https://api.airg.nov-tia.com/actions/evaluate \
  -H "X-API-Key: airg_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "http_request",
    "args": {
      "method": "POST",
      "url": "https://api.example.com/data",
      "body": {"query": "SELECT * FROM users"}
    },
    "context": {
      "agent_id": "data-pipeline-agent",
      "session_id": "run-456",
      "allowed_tools": ["http_request", "file_read"]
    }
  }' | jq .

# Full lifecycle example (Python)
import governor_client as gc

gc.GOVERNOR_URL = "https://api.airg.nov-tia.com"  # production endpoint
gc.GOVERNOR_API_KEY = "airg_..."  # your API key from the dashboard

# Step 1: Pre-execution governance
decision = gc.evaluate_action("file_write", {
    "path": "/app/config.py",
    "content": "DEBUG = True"
}, context={"agent_id": "my-agent"})

if decision["decision"] == "block":
    print("Blocked — skipping execution")
elif decision["decision"] == "allow":
    # Step 2: Execute the tool
    result = actually_write_file("/app/config.py", "DEBUG = True")

    # Step 3: Post-execution verification (optional but recommended)
    import httpx
    verify_resp = httpx.post(f"{gc.GOVERNOR_URL}/actions/verify", json={
        "action_id": decision["action_id"],
        "tool": "file_write",
        "result": {"status": "success", "output": "Wrote 1 line"},
        "context": {"agent_id": "my-agent"}
    }, headers={"X-API-Key": gc.GOVERNOR_API_KEY})
    print(verify_resp.json()["verdict"])  # "compliant" or "violation"

# Parent delegation
curl -s -X POST https://api.airg.nov-tia.com/actions/evaluate \
  -H "X-API-Key: airg_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "delegate_to_specialist",
    "args": {
      "target_agent_id": "database-specialist",
      "task": "Count active users for the weekly operations report.",
      "allowed_tools": ["execute_sql"]
    },
    "context": {
      "agent_id": "supervisor-agent",
      "session_id": "ops-weekly",
      "trace_id": "trace-ops-001",
      "span_id": "supervisor-delegation",
      "allowed_tools": ["delegate_to_specialist"]
    }
  }' | jq .

# Child specialist action
curl -s -X POST https://api.airg.nov-tia.com/actions/evaluate \
  -H "X-API-Key: airg_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "execute_sql",
    "args": {"query": "SELECT count(*) FROM users WHERE active = true"},
    "context": {
      "agent_id": "database-specialist",
      "parent_action_id": 12345,
      "allowed_tools": ["execute_sql"]
    }
  }' | jq .

# Register two agents
curl -s -X POST https://api.airg.nov-tia.com/agent-mesh/agents \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"support-agent","agent_type":"support","allowed_peers":["billing-agent"]}' | jq .

curl -s -X POST https://api.airg.nov-tia.com/agent-mesh/agents \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"billing-agent","agent_type":"billing"}' | jq .

# Evaluate an agent-to-agent call
curl -s -X POST https://api.airg.nov-tia.com/actions/evaluate \
  -H "X-API-Key: airg_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{
    "tool": "call_agent",
    "args": {
      "target_agent_id": "billing-agent",
      "requested_action": "lookup_invoice",
      "message": "Please check invoice INV-1024."
    },
    "context": {
      "agent_id": "support-agent",
      "session_id": "case-1024",
      "allowed_tools": ["call_agent"]
    }
  }' | jq .

curl -s -X POST https://api.airg.nov-tia.com/actions/verify \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action_id": 42,
    "tool": "file_write",
    "result": {
      "status": "success",
      "output": "Wrote 150 lines to /etc/passwd",
      "diff": "- root:x:0:0\n+ root:x:0:0:hacked"
    },
    "context": {
      "agent_id": "my-agent",
      "trace_id": "trace-abc"
    }
  }' | jq .

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/actions/verifications?verdict=violation" | jq .

decision = evaluate_action("shell", {"command": "ls"}, context={
    "agent_id": "my-agent",
    "conversation_id": "conv-abc-123",
    "turn_id": 1,
    "prompt": "User asked me to list directory contents"
})

curl -s -X POST https://api.airg.nov-tia.com/conversations/turns/batch \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "conversation_id": "conv-abc-123",
      "turn_number": 1,
      "role": "user",
      "content": "List the files in /tmp"
    },
    {
      "conversation_id": "conv-abc-123",
      "turn_number": 2,
      "role": "assistant",
      "content": "I will use the shell tool to list the files."
    }
  ]' | jq .

# List all conversations
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/conversations" | jq .

# Get unified timeline (turns + governance actions interleaved)
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/conversations/conv-abc-123/timeline" | jq .

curl -s -X POST https://api.airg.nov-tia.com/traces/ingest \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "spans": [
      {
        "trace_id": "trace-task-001",
        "span_id": "root-span",
        "name": "Research Market Data",
        "kind": "agent",
        "start_time": "2026-02-28T12:00:00Z",
        "end_time": "2026-02-28T12:00:05Z"
      },
      {
        "trace_id": "trace-task-001",
        "span_id": "llm-call-1",
        "parent_span_id": "root-span",
        "name": "GPT-4 reasoning",
        "kind": "llm",
        "start_time": "2026-02-28T12:00:01Z",
        "end_time": "2026-02-28T12:00:03Z"
      }
    ]
  }' | jq .

decision = evaluate_action("shell", {"command": "ls"}, context={
    "agent_id": "my-agent",
    "trace_id": "trace-task-001",
    "span_id": "llm-call-1",
})
# → A governance span is auto-created as a child of llm-call-1

# List all traces
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/traces" | jq .

# Full trace with span tree
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/traces/trace-task-001" | jq .

# Terminal
curl -N -H "Authorization: Bearer $TOKEN" \
  https://api.airg.nov-tia.com/actions/stream

# Or with API key
curl -N -H "X-API-Key: airg_your_key" \
  https://api.airg.nov-tia.com/actions/stream

const es = new EventSource(
  "https://api.airg.nov-tia.com/actions/stream?token=" + jwt
);
es.addEventListener("action_evaluated", (e) => {
  const { tool, decision, risk_score } = JSON.parse(e.data);
  console.log(`${tool}: ${decision} (risk ${risk_score})`);
});

curl https://api.airg.nov-tia.com/actions/stream/status
# → {"active_subscribers": 2, "heartbeat_interval_seconds": 15}

- policy_id: shell-dangerous
  description: "Block destructive shell commands"
  tool: "shell"
  severity: critical
  action: block
  args_regex: "(rm\\s+-rf|mkfs|dd\\s+if=|shutdown|reboot)"

{
  "tool": "send_email",
  "args": {"to": "external@example.com", "body": "Patient SSN: 987-65-4321"},
  "context": {
    "agent_id": "healthcare-support-agent",
    "session_id": "case-123"
  }
}

curl -s -X PATCH https://api.airg.nov-tia.com/policies/governance-mode \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"governance_mode": "deny-by-default"}' | jq .

curl -s -X POST https://api.airg.nov-tia.com/policies/allowlist \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "tools": ["search_kb", "summarize", "send_email"],
    "agent_id": "support-agent-1",
    "note": "Approved tools for customer support workflow"
  }' | jq .

curl -s -X PUT https://api.airg.nov-tia.com/policies/severity-weights \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "blast_radius": 0.40,
    "reversibility": 0.30,
    "data_sensitivity": 0.30
  }' | jq .

curl -s -X POST https://api.airg.nov-tia.com/policies/severity/calculate \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "blast_radius": 90,
    "reversibility": 70,
    "data_sensitivity": 100,
    "action": "block"
  }' | jq .

# Create a policy
curl -s -X POST https://api.airg.nov-tia.com/policies \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "policy_id": "block-external-uploads",
    "description": "Block HTTP uploads to external domains",
    "severity": 85,
    "action": "block",
    "match_json": {
      "tool": "http_request",
      "url_regex": "^https?://(?!internal\\.company\\.com)"
    },
    "agent_id": null
  }' | jq .

# Create an agent-specific policy using rubric scoring
curl -s -X POST https://api.airg.nov-tia.com/policies \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "policy_id": "support-review-pii-email",
    "description": "Review support-agent emails that include sensitive identifiers",
    "blast_radius": 70,
    "reversibility": 60,
    "data_sensitivity": 95,
    "action": "review",
    "match_json": {
      "tool": "send_email",
      "args_regex": "(SSN|passport|credit card|patient)"
    },
    "agent_id": "support-agent-1"
  }' | jq .

# Toggle a policy on/off
curl -s -X PATCH https://api.airg.nov-tia.com/policies/block-external-uploads/toggle \
  -H "Authorization: Bearer $TOKEN" | jq .

# Partial update (only change description and severity)
curl -s -X PATCH https://api.airg.nov-tia.com/policies/block-external-uploads \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"description": "Updated description", "severity": 95}' | jq .

# List versions
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/policies/block-external-uploads/versions" | jq .

# Restore a version
curl -s -X POST \
  "https://api.airg.nov-tia.com/policies/block-external-uploads/versions/2/restore" \
  -H "Authorization: Bearer $TOKEN" | jq .

# Check SURGE status
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/surge/status" | jq .

# List receipts
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/surge/receipts" | jq .

# Create a Slack channel
curl -s -X POST https://api.airg.nov-tia.com/notifications/channels \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "security-alerts",
    "channel_type": "slack",
    "config_json": {
      "webhook_url": "https://hooks.slack.com/services/T.../B.../..."
    },
    "is_active": true
  }' | jq .

curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/escalation/events?status=pending" | jq .

# Approve an event
curl -s -X PUT https://api.airg.nov-tia.com/escalation/events/42/approve \
  -H "Authorization: Bearer $TOKEN" | jq .

# List all fingerprinted agents
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/fingerprint/agents" | jq .

# Assess a specific action
curl -s -X POST https://api.airg.nov-tia.com/impact/assess \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"tool": "deploy_contract", "args": {}, "context": {"agent_id": "my-agent"}}' | jq .

# Get impact assessment for an agent
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/impact/assess/agent/my-agent" | jq .

# List all assessed agents
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/impact/agents" | jq .

# View live detector health
curl -s -H "Authorization: Bearer $TOKEN" \
  https://api.airg.nov-tia.com/admin/canary/status | jq .

# Run an immediate self-test before a release or during incident response
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  https://api.airg.nov-tia.com/admin/canary/run | jq .

# List all clauses
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/compliance/clauses" | jq .

# Filter by framework
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://api.airg.nov-tia.com/compliance/clauses/eu_ai_act" | jq .

# Seed clauses (first time)
curl -s -X POST https://api.airg.nov-tia.com/compliance/clauses/seed \
  -H "Authorization: Bearer $TOKEN" | jq .