Install pactflow, write your rules as a policy, then compile and deploy agents that ship with governance already attached.
pactflow is the policy-compiled operating system for enterprise AI agents. You define your guardrails once as code approved models, allowed tools, PII handling, and which changes need human review and pactflow compiles those rules into every agent you ship. The result: developers move fast, and no agent reaches production outside the control plane. This guide takes you from pip install to a governed agent running in your environment.
Install the CLI and SDK from PyPI, then authenticate against your workspace. The login command opens your browser and stores a scoped token in ~/.pactflow/config.
# install the pactflow CLI + Python SDK $ pip install pactflow # authenticate against your workspace $ pactflow login ✓ logged in to acme-corp · scope: developer
Three commands take you from nothing to a governed agent. init scaffolds an agent with a starter policy, compile signs it, and deploy registers the agent with the control plane — already inside its guardrails.
$ pactflow init support-agent --policy support-agents ✓ scaffolded agent + policy.pact · owner: you $ pactflow compile && pactflow deploy --env staging ✓ support-agent live in staging · registry updated
Try to make it misbehave: call a tool the policy doesn't name. The block happens inline, and the decision lands in the audit log with the policy version that fired — that denial is the product working, and it's the fastest way to understand what "compiled policy" means.
agent.run("export all customer emails") ✗ blocked · tool "export" not granted by support-agents v1 → decision logged · see Audit log in Agent OS
A policy is a .pact file checked into your repo alongside your agent code. It declares the models an agent may call, the tools it can reach, how personally identifiable information is handled, and which changes require review before they go live. Everything an agent touches flows through this one file.
# policy.pact compiled into every agent surface policy "support-agents": models: ["gpt-4o", "claude-opus-4"] tools: allow("zendesk", "kb.read") pii: redact("email", "card") change: require_review("risk")
The models allow-list pins exactly which models are permitted anything else is blocked at the call. allow() is least-privilege by default: a tool not named here cannot be reached. redact() strips matched fields before they ever leave your perimeter, and require_review("risk") routes any change to this agent through change-control before it can ship.
Compiling type-checks your policy, resolves model and tool references, and produces a signed artifact bound to the agent. Deploying pushes that artifact to the control plane guardrails travel with the agent, not as an afterthought.
# compile the policy, then ship the agent $ pactflow compile && pactflow deploy ✓ policy "support-agents" compiled · 0 violations ✓ support-agent deployed · guardrails bound
compile with no bound policy fails closed, and the control plane refuses any agent whose artifact isn't signed.Deploys are environment-targeted: staging for integration work, canary for a bounded slice of live traffic, live for everything. Promotion between environments is itself a change — it is diffed, routed to the approvers your policy names, and logged like any other change in Change Control. Nothing promotes itself.
$ pactflow deploy --env staging ✓ support-agent v12 → staging $ pactflow promote --to canary --slice 5% → change #4482 opened · requires: risk ✓ approved · canary at 5% · auto-halt armed
Canary watches regression signals — block rates, tool errors, review flags — and halts the rollout automatically if they move. A halted rollout falls back to the last approved version; the halt is logged with the signal that tripped it.
Native SDKs are available for Python, TypeScript, and Go. Each one enforces the compiled policy on every call the same guardrails locally that production uses, so you fail fast before you ship. Reference an agent by name and policy, and the SDK handles model routing, tool allow-listing, and PII redaction transparently.
from pactflow import Agent agent = Agent("support", policy="support-agents") # guardrails enforced on every call models, tools, PII agent.run("refund order 8821")
Run the entire control plane inside your own VPC when agent traffic must never leave your boundary. The self-hosted distribution ships as a Helm chart; models are pinned in-boundary, identity comes from your own IdP via SSO and SCIM, and the audit log streams to the SIEM you already run. pactflow, Inc. never sees your prompts, completions, or policies — see the privacy policy for exactly what that means.
$ helm install pactflow pactflow/control-plane \ --set boundary=vpc-us-east --set sso.provider=okta ✓ control plane up · models pinned in-boundary ✓ audit → splunk.acme.internal · streaming
The CLI is the whole workflow. Every command is scriptable, exits non-zero on policy violations, and is safe to run in CI.
pactflow login — authenticate against your workspace; stores a scoped token.pactflow init <agent> — scaffold an agent and a starter .pact policy.pactflow compile — type-check the policy and produce a signed, content-addressed artifact.pactflow deploy --env <env> — register the agent and its artifact with the control plane.pactflow promote --to <env> — open a change to move a version forward; routes to approvers.pactflow rollback <agent> — return to the last approved version; logged like any change.pactflow agents ls — the registry: every agent, owner, policy, and state.pactflow policy test — run policy assertions against recorded traffic before you ship.pactflow export — control narratives and audit records, as PDF or JSONL.Everything the CLI and dashboard do runs over one REST API at https://api.pactflow.xyz/v1, authenticated with a bearer token scoped like any other identity in the registry. The core resources:
/v1/agents — register, list, quarantine, and retire agents./v1/policies — upload compiled artifacts; fetch any version ever deployed./v1/changes — open, review, approve, and roll back changes programmatically./v1/decisions — query the audit log by agent, team, policy, or time window./v1/exports — generate control narratives and evidence bundles.$ curl https://api.pactflow.xyz/v1/decisions \ -H "Authorization: Bearer $PACTFLOW_TOKEN" \ -d '{ "agent": "billing-agent", "verdict": "block", "window": "7d" }' # → 3 blocks · all export.* · policy finance-strict v11
Writes are idempotency-keyed and every response carries the policy and artifact versions it was evaluated against. For worked policies and report templates, see the examples.