Runtime infrastructure for AI agents · Live
Every AI agent needs
a control layer.
Firewalls protect networks.
Identity systems protect users.
Causalor protects autonomous decisions.
It monitors, constrains, repairs, and explains every action your agents take in production, in real time, before each one runs.
pip install causalor
Two ways it holds the line
A hard stop for the action.
A live correction for the drift.
Most agent failures are one of these two, and they happen at different moments. The repair works while the agent is still reasoning, so the bad action is often never proposed. The block sits at the commit point and makes crossing the line impossible. Two layers of one control.
The block
deterministic · proof-backed
Stops the action itself, not the words around it.
Each tool call is checked against the typed constraints before it executes. If it violates one, the call never runs, and Causalor writes a proof recording the state, the rule, and the verdict. Re-run the proof on the same inputs and you get the same answer. This is the guarantee you can take to a compliance review.
The repair
continuous · measured
Catches an agent drifting off-plan and puts it back on course.
Not every failure is a single bad tool call. Some are slow drift over a long task, and by the time it reaches a tool call the damage is already in the reasoning. Causalor scores that drift and writes a correction into the next turn, often before a violating action is ever proposed. You never diagnose the drift or author the fix. Every correction is then measured on the turns that follow, so the effectiveness you see is observed rather than asserted, and it sharpens per agent over time.
Connect
Three ways to put Causalor in the path.
Same deterministic guarantee on every route. Pick by trust boundary, move between them later without re-authoring anything.
See it work, end to endHosted gateway
Trying it out. Two lines, no deploy.
Point your existing OpenAI or Anthropic SDK at the gateway. Governed on the first call.
OpenAI(base_url="gw.causalorlabs.com/v1")Sidecar
Production. Traffic stays in your VPC.
The same gateway image in your own VPC, so LLM traffic never leaves it. One container, one host to reach.
docker run ghcr.io/causalorlabs/causalor-gatewayIn-process SDK
Maximum control. No new failure point.
Enforce in-process: block the action and pull live repairs. Or run fully airgapped, hard block only.
pip install causalorBlocking needs no key at all
In-process, pre_commit is a local call: the verdict is computed in your process, with no model call and no account. A cal_ key, shown once on sign-in, is what adds correction and the audit record. The Quickstart starts with the part that needs neither.
The sidecar is one container
Nothing else installs on your side. ClickHouse, the causal graph, embeddings, and the repair workers all stay in Causalor's cloud; the container just reaches them over HTTPS.
You set the limits
You decide what the agent may do. It stays as open-ended as you built it.
You are not rewriting the agent into a rulebook. You are drawing the lines it must not cross, and Causalor holds it to them from the outside. To skip the blank page, it reads the agent’s prompt and tool schemas and proposes limits you can accept. Edit one, drop one, or add a limit the prompt never mentioned. What you confirm is enforced exactly, on every call.
Set your agent’s limits
Start in observe mode
Watch your live agents first. Then govern them.
Point a production agent at Causalor with no limits set and every run is white-boxed: where it drifted, which limits it would have crossed, which failure modes keep repeating, on real traffic, not a fixed test set. When the picture is clear, turn on correction and blocking and it governs those same agents in production.
Where it fits
The rest of the stack watches. Causalor acts.
The rest of the stack
- ·Observability (Langfuse, LangSmith): shows the trace, after the fact
- ·Eval suites: score the agent in staging, on a fixed test set
- ·Guardrail libraries: keyword and regex filters on text
- ·None of them act on what they find, in production
Causalor
- +Scores every action live, on real production traffic
- +Corrects the agent, or blocks the action, in real time
- +Every decision carries a replayable proof
- +The limits are yours, enforced deterministically
Institutional memory
The longer your agents run, the more Causalor knows how they fail.
Every drift, block, and repair is kept permanently and scoped to your account, never dropped when it scrolls off a dashboard. The exact state, the exact rule, the exact fix, retained and queryable.
It is yours to export, and it is the part of your governance a competitor cannot clone.
- constraint
- loan.fraud_required
- state
- fraud_check_done = false
- fix
- constraint_reinforcement
- proof
- sha256:f735f27c…
First recorded on day 3. Still queryable, and feeding the guardrails your next agent inherits.
Start free
Put your agents under control today.
Connect an agent, watch where it breaks, then turn on correction and blocking. Two minutes, no card.