Governed agents in your framework of choice
One pattern, three frameworks: governance wraps the tool, never a step in the graph, a member of the crew, or a node the model could route around. A step the model chooses is a step the model can be talked out of choosing — wrapping the tool itself means the only path to the real function that the agent is given goes through the gate, whichever framework is doing the reasoning above it. That wrapper runs in your own process and is cooperative; the enforcement boundary is a separate gateway process that holds the tool and its credentials and re-verifies the signed request.
Pick your framework
- LangGraph — governance is not a graph node; the graph is unchanged
- OpenAI Agents SDK — guard on the inside, @function_tool on the outside
- CrewAI — a two-agent crew; only the consequential agent's tool needs a gate
- NVIDIA OpenShell — a sandbox middleware; OpenShell decides where, Metamynd decides whether
One instinct to unlearn
Every framework here ships something that looks like it solves this — a Task guardrail, an input_guardrail/output_guardrail. They inspect what the model SAID, its input or output text. None of them can see the signed action — the amount, the merchant, the scope, checked against a mandate its owner actually issued — before the real function is ever called.
What's deliberately left ungoverned
Every example wraps exactly one consequential tool and leaves read-only lookups unwrapped on purpose — a control on a call that can't spend money or change anything just adds latency, and a control that slows the ordinary path is a control teams remove. The corollary: an unwrapped tool is an ungoverned tool. Deciding which of yours are consequential is a design step, not a default.