Govern an agent in about two minutes.

Three steps. The middle one is a choice between three ways to connect, and they all run the same enforcement engine, so you can start on one and move later without re-authoring anything.

Plain markdown version, for your coding agent

Get your key

Open the console

Connect, whichever way suits you

Pick by trust boundary, not by feature set. Every route gets identical enforcement and the same console.

Route	Use when	Your change	Model traffic
Hosted gateway	Trying it out	Change one URL	Through us
In-process SDK	No proxy in the model path	Add a check at irreversible actions	Never leaves you
Sidecar gateway	Production, traffic stays in your VPC	Run a container	Stays in your VPC

Point your existing OpenAI or Anthropic client at the gateway. You bring your own model key in a header; it is forwarded and never stored.

.env

CAUSALOR_API_KEY=cal_...        # your Causalor key (shown once on sign-in)
CAUSALOR_UPSTREAM_KEY=sk-...    # your OpenAI key; never stored

your code

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://gw.causalorlabs.com/v1",
    api_key=os.environ["CAUSALOR_API_KEY"],
    default_headers={
        "X-Causalor-Upstream-Key": os.environ["CAUSALOR_UPSTREAM_KEY"],
        "X-Causalor-Agent": "my-agent",
    },
)

Anthropic works the same way: Anthropic(base_url="https://gw.causalorlabs.com", auth_token="cal_...").

Review and activate your guardrails

After the first call your agent appears in the console. Open Guardrails: Causalor reads the agent's own system prompt and tool schemas and proposes typed, checkable constraints bound to your real field names. Edit a limit, drop one, add your own, then Activate. From then on every violating tool call is stopped with a replayable proof, and drift is corrected in flight.

See it work

The same guarantee, provable in ten lines.

Whichever route you pick, a blocked action returns a replayable proof. Here it is at its smallest: an in-process check with no proxy and no model, so you can run it right now.

install

pip install causalor

run this

from causalor import Causalor, AgentStateSchema, FormalConstraint

schema = AgentStateSchema(version="1.0.0")
schema.register_field("refund_amt", "number")

c = Causalor(tenant_id="getting-started")
c.set_state_schema(schema)
c.register_constraints([FormalConstraint(
    constraint_id="refund_ceiling", variable="refund_amt",
    operator="<=", threshold=500, scope="SAFETY_CONSTRAINT",
)], replace=True)

# the agent tries to refund $900
result = c.pre_commit("customer-42", "issue_refund", state={"refund_amt": 900})
print(result.allowed)   # False

real output

allowed: False   status: VIOLATION
proof: refund_amt=900 <= 500 -> False
       constraint_id=refund_ceiling   actual=900   threshold=500
       state_snapshot_hash=sha256:v1:766ccc52...   (same inputs -> same hash)

Run it twice and the hash is identical. That reproducibility is what separates a proof from an opinion, and it is why the record holds up in an audit. On the hosted gateway and the sidecar this exact check runs inline on every tool call, and the proof rides on the response (X-Causalor-Blocked).

Works with any framework

LangChain, LlamaIndex, AutoGen, CrewAI, or your own loop. It governs at the model-call boundary.

Start free