<!-- SPDX-License-Identifier: Apache-2.0 -->
**Status:** stable · **Owner:** Developer Relations · **License:** Apache-2.0

# Playbook 1 — Govern Your Agent

> Make **any** agent — Claude Agent SDK, OpenAI Agents SDK, LangChain, CrewAI,
> a plain `while` loop, a Cloudflare Worker — emit a complete, verifiable
> evidence trail of *who acted on whose behalf, for what purpose, and with what
> outcome*. Provider-agnostic. No KYE runtime required to start.

## 1. The problem

Policies describe intent. Logs describe what happened. Neither *proves authority
at the moment of execution*. When an auditor asks "was this agent allowed to do
that, and can you prove it from public keys alone?", a chat transcript is not an
answer.

KYE closes this with two artefacts your agent emits:

- a **§52 binding** at task-start — the agent's declared identity, purpose and
  scope, and
- the **§0.3 evidence family** at each privileged step + task-end — the signed
  record an auditor can replay.

Emitting both is the whole game. This playbook is the provider-agnostic pattern.

## 2. The pattern

```
task dispatched
   │
   ├─▶ (a) emit a binding         → kye.agent.governance.v1
   │        (agent_id, purpose, scope.read_paths/write_paths, mcp_allow_list)
   │
   ├─▶ for each privileged action:
   │        (b) emit a tool-call  → kye.evidence.tool_call.v1
   │        (c) record the verdict→ kye.evidence.decision_map.v1
   │
   ├─▶ if the task would breach the binding (out-of-scope path, disallowed MCP
   │        server, a chapter the agent must not touch):
   │        (d) refuse-and-route  → kye.agent.refusal.v1   (and STOP)
   │
   └─▶ task ends
            (e) emit a completion → kye.agent.completion.v1
                 (outcome, files_touched, mcp_calls_made)
```

The binding (a) is the contract; the completion (e) is the reconciliation — a
post-flight check that what the agent *did* stayed inside what it *declared*. A
refusal (d) is a first-class success, not an error: a governed agent that
declines an out-of-scope instruction is behaving correctly.

### Provider mapping

The pattern is identical regardless of framework — only the hook point changes:

| Framework | Where (a) goes | Where (b)/(c) go | Where (e) goes |
|---|---|---|---|
| Claude Agent SDK / OpenAI Agents SDK | before the run loop | tool-use callback | after the run loop |
| LangChain / LangGraph | `on_chain_start` | `on_tool_start` / `on_tool_end` | `on_chain_end` |
| CrewAI | crew kickoff | task callback | crew completion |
| Plain function / Worker | top of the handler | around each side-effect | `finally` block |

You write the emission once; the framework decides *when* to call it.

## 3. The public artefacts

The envelope **shapes** are public vocabulary — illustrative instances live in
[`public/examples/agent-governance/`](../../examples/agent-governance/):

- Binding (task-start):
  [`governance-content-author-1.json`](../../examples/agent-governance/governance-content-author-1.json)
  → schema `kye.agent.governance.v1`
- Completion (task-end):
  [`completion-content-author-1.json`](../../examples/agent-governance/completion-content-author-1.json)
  → schema `kye.agent.completion.v1`
- Refusal (constitutional violation):
  [`refusals/refusal-chapter-violation-1.json`](../../examples/agent-governance/refusals/refusal-chapter-violation-1.json),
  [`refusals/refusal-path-violation-1.json`](../../examples/agent-governance/refusals/refusal-path-violation-1.json),
  [`refusals/refusal-mcp-violation-1.json`](../../examples/agent-governance/refusals/refusal-mcp-violation-1.json)
  → schema `kye.agent.refusal.v1`

The per-decision evidence family (`kye.evidence.tool_call.v1`,
`kye.evidence.decision_map.v1`, `kye.evidence.pack.v1`) is documented in the
[vocabulary](../../vocabulary/) and consumed by the SDKs in the
[packages catalogue](../packages.html).

### Minimal binding (copy-paste starting point)

```jsonc
{
  "schema": "kye.agent.governance.v1",
  "agent_id": "my-tenant-invoice-agent",
  "purpose": "reconcile inbound invoices against open purchase orders",
  "scope": {
    "read_paths":  ["invoices/**", "purchase-orders/**"],
    "write_paths": ["reconciliations/**"]
  },
  "mcp_allow_list": [],
  "constitutional_acknowledgement": ["§0", "§0.3", "§52"]
}
```

The runnable version of this is the
[`governed-agent`](../agent-dev-kit-templates/governed-agent/) starter template.

## 4. What stays KYE-side

This playbook discloses the **pattern and the public envelope shapes** only. The
KYE Reference Gateway™ owns everything that turns those envelopes into a
courtroom-grade proof — signing-key derivation, the Decision Map predicate
ordering, the Evidence Pack canonicalisation, and the Replay-Proof™ construction.
You never re-implement those. Your agent emits the public envelopes; the gateway
(or the SDK's local signer) seals them so that the result is verifiable from the
published JWKS alone.

## Next

- Playbook 2 — [authority-finality](./authority-finality.md): the full
  discover → authority → purpose → evidence → finality recipe.
- Scaffold it: [`governed-agent` template](../agent-dev-kit-templates/governed-agent/).