GATE documentation
GATE (Guarded Agent Tool Execution) is a runtime security layer for LLM agents. It wraps an existing agent framework, intercepts every guarded tool call before dispatch, and returns one of three decisions:
- ALLOW: the call proceeds to the original tool body unchanged.
- BLOCK: the call is refused and
ToolExecutionBlockedis raised instead of the tool output. - ESCALATE: the call is withheld and routed to a human approval queue. With no queue configured, it remains withheld.
GATE does not replace the agent loop, the planner, or the tools. The framework keeps running its own graph or execution loop; only the dispatch boundary of the tools it owns is guarded.
Suggested reading order
The pages below form a guided path from “what it does” to “how it is built” to “how to deploy it”. Read them top to bottom. The documentation map further down is the same set, organised by topic for reference.
- Installation — requirements, extras, verified framework versions
- Quick start — a minimal guarded agent, block handling, HITL, audit
- Framework scenarios — one policy and scenario across all four frameworks
- Architecture — components, request lifecycle, state machine, failure semantics
- The security pipeline, in check order:
- Privilege — tool allow-lists, data scope, budget checks
- DFA supervision — phases, transitions, step and loop budgets
- Smart contracts — preconditions and postconditions
- Semantic firewall — SSS scoring, intent anchor, thresholds
- D-CBF monitor — barrier functions and forward invariance
- Enforcement plumbing —
ToolEnforcement, guards, argument marshalling, timeouts - Configuration — every field and whether the runtime uses it
- Adapters — what complete mediation means per framework:
- Human-in-the-loop — approval queue, channels, SLA, sync approval
- Audit — encrypted log, PII masking, KMS backends, retention
- Security model — threat model, guarantees, known gaps
- Standalone utilities — tenant isolation, irreversibility, circuit breaker, Neural CBF
- Testing — test layout and how to run the real-framework integration tests
- FAQ — common questions and pitfalls
Documentation map
| Page | Contents |
|---|---|
| Installation | Requirements, extras, verified framework versions, model download |
| Quick start | A minimal guarded agent, block handling, HITL, audit |
| Framework scenarios | The same policy and scenario in all four frameworks, with keyless drivers |
| Architecture | Components, request lifecycle, state machine, concurrency, failure semantics |
| Enforcement plumbing | ToolEnforcement, guards, argument marshalling, timeouts, custom adapters |
| Privilege | Tool allow-lists, data scope, budget checks |
| DFA supervision | Phases, transitions, step and loop budgets |
| Smart contracts | Preconditions, postconditions, built-in contracts, custom contracts |
| Semantic firewall | SSS scoring, intent anchor, prototypes, thresholds, limitations |
| D-CBF monitor | Barrier functions, forward invariance, defaults, limitations |
| Configuration | Every configuration field and whether the runtime uses it |
| Adapters | What complete mediation means per framework |
| LangChain | AgentExecutor and compiled agent graphs |
| LangGraph | Compiled StateGraph with ToolNode |
| OpenAI Agents SDK | Agent, FunctionTool, handoffs, hosted tools |
| CrewAI | Crew, agent tools, task tools |
| Human-in-the-loop | Approval queue, Slack/PagerDuty channels, SLA, sync approval |
| Audit | Encrypted audit log, PII masking, KMS backends, retention |
| Security model | Threat model, guarantees, known gaps, deployment guidance |
| API reference | Public classes, methods, models, exceptions |
| Testing | Test layout, real-framework integration tests, how to run them |
| Standalone utilities | Tenant isolation, irreversibility, circuit breaker, Neural CBF |
| FAQ | Common questions and pitfalls |
At a glance
| Item | Value |
|---|---|
| Distribution name | GATE-security |
| Import package | gate |
| Version | 1.1.1 |
| Python | 3.9 or newer |
| License | MIT |
| Runtime dependencies | pydantic, numpy, faiss-cpu, sentence-transformers, tenacity |
| Supported frameworks | LangChain, LangGraph, OpenAI Agents SDK, CrewAI |
| Decision model | Ternary: ALLOW, BLOCK, ESCALATE |
Scope of this repository
This repository contains the runtime framework, its adapters, and their tests. The evaluation harness, benchmark data, and manuscript are maintained separately and are not part of this distribution.
Citation
Citation details are being finalised. The repository README and CITATION.cff carry the current reference.
Status
GATE is at version 1.1.1. The adapter integration tests drive real framework dispatch paths, but the semantic firewall and D-CBF stages are not a substitute for application-level authorization. Read Security model before deploying GATE in a production path. Security reports follow SECURITY.md.