infy’s core has no third-party runtime dependencies. Governance is optional: omit it and nothing is imported, opt in and every tool call is policy-checked in-process (about 50 microseconds per call).
Install
Install the core plus one provider extra. The examples below use OpenAI.OPENAI_API_KEY for the OpenAI examples).
During alpha, install from source until the first tagged PyPI release. See
CONTRIBUTING.md for pip install -e ".[dev]" and maturin develop --release.1
Call a model
A Every provider implements the same protocol, so
ChatModel takes a list of messages and returns an AIMessage. Read the reply text off .text.agenerate, stream, and astream are available on the same object, and providers are interchangeable in chains, agents, and graphs.2
Give it a tool
Wrap a plain function with
@tool, then pass it to create_agent. The docstring becomes the tool description and the type hints become its schema.create_agent returns a callable that runs a tight loop: the model is called, any tool calls it makes are executed (in parallel by default), the results are fed back, and the loop repeats until the model stops calling tools or max_iterations (default 10) is reached. The call returns an AgentResult with messages, response, iterations, and tool_calls_made.3
Make it safe with governance
Now give the agent tools with real authority and put a control plane in front of them. Build a Three things are now true for every tool call:
Governance object and pass it to create_agent with the governance keyword. Nothing else about the agent changes.- Deny wins.
delete_databaseis on thedenylist, so the call never executes. The agent receives the block reason as the tool result and adapts. Denials are still audited. - Approval gates the rest.
deployrequires a human yes. TheCallbackApproveris handed anApprovalRequest(itstool,args,risk_tier, andreason), and the call runs only if your callback returnsTrue. - Everything is recorded.
gov.audit.verify()walks the hash-chained log and confirms it has not been tampered with.
What just happened
The governed loop adds four checks at the existing model and tool chokepoints, in-process, with no network hop:
For sign-off that cannot happen inline,
DurableAgent suspends a run, persists it, and resumes minutes or hours later once a human decides, with each approval cryptographically bound to the exact action (TOCTOU-safe). See the governance guide for the durable flow.
Next steps
Governance overview
Policy, risk tiering, approval gates, durable approval, and the tamper-evident audit in depth.
Tools and agents
The
@tool decorator, create_agent, create_async_agent, and parallel tool execution.Govern any agent
Wrap smolagents, LangChain, and OpenHands agents with the same governance, unchanged.
The graph runtime
StateGraph, reducers, checkpointing, and human-in-the-loop interrupts for branching flows.