Skip to main content
infy is open core under Apache-2.0. Everything in the repository is free to use, self-host, and build on, forever. That includes the full in-process governance library, not a stripped demo of it. The commercial Infyrence layer is a separate, operated surface that begins where in-process enforcement ends, at the network boundary. It attaches behind the same open protocol seams, so adopting it is never a fork and never a rewrite.

​
What is free forever

The infy package on this repository is Apache-2.0 in its entirety. The framework and the governance library are one codebase, and the governance library is not gated:
  • The chat-model abstraction, composable runnables, structured output, create_agent, and the StateGraph runtime.
  • The Policy engine with deny-by-default, fail-closed, Cedar-style semantics behind the PolicyEngine protocol.
  • Risk tiering, the Approver protocol, CallbackApprover, and the durable-approval primitives (DurableAgent, DurableApprover, InMemoryApprovalStore).
  • The local, hash-chained, tamper-evident audit log with verify().
  • The framework integrations in infy.integrations that govern smolagents, LangChain, and OpenHands agents.
The enforcement code is open on purpose. A control plane you cannot read is one you cannot trust, so the policy engine, the approval gate, and the audit chain are all in the repository for you to inspect and self-host.

​
What Infyrence operates

The commercial layer is operated by Infyrence and is not in this repository. It is the managed, multi-tenant surface for the pieces that are heavy, stateful, or need to live outside the agent process: durable audit storage, hosted human approval, and centrally managed policy. The split follows a clear line. In-process enforcement stays open and local, because a network hop before every tool call would erase the cold-start and latency advantage that makes infy worth using. Everything past the network boundary is where Infyrence operates.

​
The seams that connect them

The commercial features do not replace the open ones. They implement the same protocols the open library already defines: the PolicyEngine seam, the Approver protocol, and the audit interface. You can start with the in-process library, self-hosted and free, and later point the same Governance object at an operated policy source, approval inbox, or audit sink without touching your agent code.
There is no fork and no lock-in at the enforcement boundary. The protocol seams are the contract, and both the open library and the commercial layer are written against them.

​
Why the boundary sits where it does

1

Enforcement is in-process by design

Policy checks run at the tool chokepoint in about 50 microseconds. A policy microservice with a network hop before every tool call would erase the cold-start and latency advantage the framework is built for, so enforcement stays local and open.
2

Operated concerns cross the network boundary

Durable audit sinks, hosted approval queues, and multi-tenant policy management are stateful, need to outlive the agent process, and are shared across teams. Those are the commercial layer.
3

The protocol seams keep both sides honest

Because the commercial layer attaches behind PolicyEngine, Approver, and the audit interface, you can adopt it incrementally and leave it at any time.

​
Deferred behind the same seams

Some capabilities are designed but held back behind the stable protocol seams until a design partner pulls them: an embedded Cedar engine compiled into infy_core, a YAML-to-policy DSL, taint and provenance with egress DLP for prompt-injection defense, plan-level authorization, and capability attenuation across sub-agents. When they land, they attach at the same seams, so nothing you build today is invalidated.

Governance overview

How the in-process control plane policy-checks every tool call and writes a tamper-evident audit.

Durable approval

Suspend a run for out-of-band human sign-off and resume it hours later, TOCTOU-safe.