# AI Agents

Source: https://www.primust.com/agents
HTML title: Instrument AI Agent Runs — Primust
Meta description: After primust init, a startup hook records the governance envelope as the agent run executes and emits a VPEC at the session boundary.

← Primust · AI Agents
# Instrument the run. _Verify the credential._

After primust init, a startup hook records the governed session as it executes and emits a VPEC at the boundary without changing your agent code.

§ 01 — Premise

## One governed run. _One portable credential._

An AI agent is a sequence of tool calls made under probabilistic control. The runtime moves fast; the review question does not. With Primust in the path, the run has a neutral record: which tools ran, what input they saw, what was blocked, and whether the claimed policy pack was active.

After _primust init_, a standard Python startup hook auto-detects the agent runtime on import and puts Primust in the path before the governed session starts. It records the session while it runs, and a VPEC is emitted at the session boundary. Supported frameworks do not require agent-code changes or model-provider changes. Governed content does not need to leave your environment — only commitment hashes and execution metadata.

§ 02 — Zero-code install

## Wrap what already runs.

setup.sh one-time

$ pip install primust

$ primust init # RFC 8628 device flow + framework detection + hook wiring

After `init`, Primust auto-activates on every Python process via a standard `.pth` file. No imports, no wrappers, no decorators required — your existing agent code emits VPECs at session boundaries.

agent.py your code · unchanged

import langgraph # or crewai, openai_agents, llamaindex, dspy, haystack, litellm, strands, mcp, bedrock, …

 

graph.invoke(input_data) # every tool call, every policy gate captured into a VPEC

Need explicit scope — a specific policy pack, a manual decision boundary, or a custom Pipeline? The lower-level primitives are still exposed: `primust.Pipeline()`, `primust.adapters.autoinstrument()`, and the `@record_check` decorator. Opt out of auto-activation with `PRIMUST_AUTO_ACTIVATE=0`.

§ 03 — Agent adapters

## Every supported agent adapter. _Plus custom hooks._

Most ship inside the single `primust` package. `autoinstrument()` auto-detects whichever frameworks are imported in your process; custom checks and explicit pipelines cover proprietary agent code.

Name

Integration path

Mode

What it does

OpenAI Agents SDK

primust

Python

Wraps Agents SDK runs, tool calls, handoffs, tracing spans.

LangGraph

primust

Python

Node-level and edge-level instrumentation. Bind graph traversal to the VPEC.

Google ADK

primust

Python

Agent Development Kit runs and tool invocations.

Microsoft Agent Framework

primust

Python

MSAF agents, skills, and orchestration.

Pydantic AI

primust

Python

Tool calls and validator decisions bound to the VPEC.

Semantic Kernel

primust

Python

SK functions, planners, and kernel invocations.

OpenTelemetry

primust

Python · JS · Go

Back OTel spans into Primust. Use for unsupported frameworks.

CrewAI

primust

Python

Crew tasks open/close per decision. Role, tool use, and handoffs recorded.

AG2 (AutoGen)

primust

Python

Multi-agent conversations instrumented. Agent-to-agent message commits.

LlamaIndex

primust

Python

Retriever, query-engine, and agent tool calls bound to the VPEC.

LiteLLM

primust

Python

Unified LLM interface. Every completion across 100+ providers recorded.

DSPy

primust

Python

DSPy modules and optimizers instrumented. Teleprompter runs captured.

Haystack

primust

Python

Pipeline components, retrievers, and generators recorded per run.

Strands

primust

Python

Strands agent tool calls and tool-use policy wrapped into the VPEC.

AWS Bedrock

primust

Python

boto3 Bedrock runtime. InvokeModel and Agent calls bound via HTTP events.

MCP

primust

Python

Model Context Protocol servers instrumented. Tool listings and calls recorded.

Custom checks

primust

Python

@record_check wraps your own governance logic, validators, or internal tools.

Custom pipeline

primust

Python

Pipeline() gives explicit run boundaries for proprietary agents and bespoke orchestration.

§ 04 — Rule engines

## OPA, Cedar, Drools, and ODM. _Policy proof in the same credential._

Agent adapters record what the agent did. Rule-engine adapters record the deterministic policy decisions around that action. Both land in the same VPEC, so a reviewer can see the tool call and the policy result together.

Name

Integration path

Mode

What it does

Open Policy Agent

primust

Rego

Decision log becomes a check execution record. Every opa eval can produce a VPEC-bound result.

Cedar

primust

Cedar

Policy evaluation results become check records with the policy pack hash.

Drools

primust

DRL · Java

Rule activations recorded. Agenda and working-memory commits attached.

IBM ODM

primust

ARL · Decision

Decision service calls wrapped. Rule flow and outcome bound to the VPEC.

AWS Cedar / AgentCore

primust

Cedar

Complementary: Cedar enforces policy, Primust proves it ran as declared.

§ 05 — What's recorded

## Fourteen stage types. _Full governance envelope._

Adapters classify every observable action into a _stage type_, and every stage gets wrapped in the same governance envelope — policy gates, blocks, gaps, and per-check records. All bound to one VPEC per session, all verifiable offline.

Stage types · the "what happened" axis

llm_api

raw model API call (OpenAI, Anthropic, Bedrock, Gemini, any HTTP LLM)

lm_call

framework-abstracted language model call (LiteLLM, LangChain)

tool_call

registered tool / function invocation

mcp_tool_call

Model Context Protocol tool resolution

retriever_call

RAG retrieval · vector-store query · doc lookup

agent_step

CrewAI task step · OpenAI Agents step · AG2 agent turn

graph_node

LangGraph node execution · edge traversal

pipeline_component

Haystack component execution

module_execution

DSPy module / teleprompter run

deterministic_rule

regex, threshold, Cedar/OPA/Drools rule evaluation

decision_path_model

ML classifier / scoring model invocation

bound_committed_inference

ZKML-witnessed forward pass (Mathematical ceiling)

open_source_ml

sklearn · torch · transformers · statsmodels

custom_check

@record_check decorator — your own governance logic

Governance envelope · the "did the policy catch it" axis

policy_gate

a declared check ran on the proposed action

id, verdict (allow/block/warn), floor, visibility

blocked

the policy pack forbade an attempted action

attempted name, reason code, policy reference

gap

a declared check could not be verified end-to-end

G-001…G-048 taxonomy code, scope, reason

handoff

agent → agent delegation

from, to, handoff_reason, input commit

external_egress

any network call outside the declared allowlist

host, path, bytes_out commit, policy verdict

check_execution

per-check record in the VPEC

id, result, took_ms, proof_level, visibility

Content bodies never transit Primust — only Poseidon2 / SHA-256 commitment hashes. 19 built-in check executors cover the common cases; `@record_check` extends to anything your team writes.

§ 06 — Headless / CI

## No browser. _Still zero-code._

Servers, containers, GitHub Actions, batch jobs — anywhere `primust init`'s device flow can't open a browser. Two clean paths, both land at the same `./.primust/config.toml` the interactive flow produces.

Option A · API key env var most CI / containers

# GitHub Actions / Docker / K8s secret

$ export PRIMUST_API_KEY= pk_live_...

$ python my_agent.py

 

# auto-activation picks up the env key

# on every Python process

Option B · primust auth --headless ssh / remote boxes

$ primust auth --headless

# prints a device-flow URL + code

# copy to a browser on any device

 

→ https://app.primust.com/activate

code: XK7H-QM2L

Claude Enterprise managed-settings can pre-provision `PRIMUST_API_KEY` + `PRIMUST_MANIFEST_ID` so developer machines skip `primust init` entirely — IT owns the key, devs can't opt out.