Put a Decionis policy decision in front of current AutoGen Core tools or the legacy AutoGen 0.2 UserProxyAgent function-execution hook.
The current wrapper intercepts BaseTool.run before run_json delegates to the original tool. The optional legacy subclass intercepts both execute_function and a_execute_function on UserProxyAgent.
pip install decionis-autogen
# AutoGen 0.2 UserProxyAgent hook:
pip install 'decionis-autogen[legacy]'Release state: the package source, tests, build metadata, and release automation are complete. PyPI availability begins after the package release workflow is approved; this page does not present an unpublished artifact as live.
from autogen_core.tools import FunctionTool
from decionis import DecionisClient
from decionis_autogen import guard_tool
refund = FunctionTool(send_refund, description="Issue refund")
guarded_refund = guard_tool(
inner_tool=refund,
client=DecionisClient(api_key="..."),
tenant_id="your-org-uuid",
workflow_key="refund_execution",
shadow_mode=True,
)
agent = AssistantAgent(..., tools=[guarded_refund])ALLOW delegates to the original tool. BLOCK, REVIEW_REQUIRED, ESCALATE, and ERROR stop execution. In Shadow Mode, the same verdict is recorded with dossier evidence while the original tool continues to run.
The original name, description, and argument schema stay visible to the agent.
Tool arguments are included in the canonical Decionis decision request before execution.
Each decision returns a dossier id, reason codes, and an optional verification link.
Set shadow_mode=True first; remove it after the observed verdicts match the intended policy.
Run the open AI Action Risk Index benchmark to see destructive SQL, credential exposure, and unbounded fan-out cases.
Use the browser sandbox to validate the policy response, then wrap the corresponding framework tool and collect a week of observed evidence.
Open the developer sandbox