Skip to main content
Get from a first model call to a fully governed agent in a few minutes. This page walks three steps: call a model, give it a tool, then put that same agent behind a policy that denies destructive actions, requires human approval for risky ones, and writes a receipt you can verify.
infy’s core has no third-party runtime dependencies. Governance is optional: omit it and nothing is imported, opt in and every tool call is policy-checked in-process (about 50 microseconds per call).

Install

Install the core plus one provider extra. The examples below use OpenAI.
Requires Python 3.10 or newer. Set your provider key in the environment (OPENAI_API_KEY for the OpenAI examples).
During alpha, install from source until the first tagged PyPI release. See CONTRIBUTING.md for pip install -e ".[dev]" and maturin develop --release.
1

Call a model

A ChatModel takes a list of messages and returns an AIMessage. Read the reply text off .text.
Every provider implements the same protocol, so agenerate, stream, and astream are available on the same object, and providers are interchangeable in chains, agents, and graphs.
2

Give it a tool

Wrap a plain function with @tool, then pass it to create_agent. The docstring becomes the tool description and the type hints become its schema.
create_agent returns a callable that runs a tight loop: the model is called, any tool calls it makes are executed (in parallel by default), the results are fed back, and the loop repeats until the model stops calling tools or max_iterations (default 10) is reached. The call returns an AgentResult with messages, response, iterations, and tool_calls_made.
For async, use create_async_agent, which returns a coroutine yielding the same AgentResult.
3

Make it safe with governance

Now give the agent tools with real authority and put a control plane in front of them. Build a Governance object and pass it to create_agent with the governance keyword. Nothing else about the agent changes.
Three things are now true for every tool call:
  • Deny wins. delete_database is on the deny list, so the call never executes. The agent receives the block reason as the tool result and adapts. Denials are still audited.
  • Approval gates the rest. deploy requires a human yes. The CallbackApprover is handed an ApprovalRequest (its tool, args, risk_tier, and reason), and the call runs only if your callback returns True.
  • Everything is recorded. gov.audit.verify() walks the hash-chained log and confirms it has not been tampered with.
Governance is deny-by-default and fail-closed. If policy, risk, or approval raises, the call is denied, not silently allowed, and the denial is audited. With no approver configured, high-risk calls default to DenyAll.

What just happened

The governed loop adds four checks at the existing model and tool chokepoints, in-process, with no network hop: For sign-off that cannot happen inline, DurableAgent suspends a run, persists it, and resumes minutes or hours later once a human decides, with each approval cryptographically bound to the exact action (TOCTOU-safe). See the governance guide for the durable flow.

Next steps

Governance overview

Policy, risk tiering, approval gates, durable approval, and the tamper-evident audit in depth.

Tools and agents

The @tool decorator, create_agent, create_async_agent, and parallel tool execution.

Govern any agent

Wrap smolagents, LangChain, and OpenHands agents with the same governance, unchanged.

The graph runtime

StateGraph, reducers, checkpointing, and human-in-the-loop interrupts for branching flows.