MAEA Trust Tier — Enterprise Agent Governance Plugin for Dify

[kuangmi-bit]

What it does

Adds a policy enforcement layer between "LLM decides to call a tool" and "tool executes" — something Dify does not currently provide. Three tools:

Tool	What it checks
Trust Tier Check	Four-tier model (sandbox→internal→production→privileged), delegation depth limits, tool allow/block lists
Rate Limiter	Per-agent, per-tool call throttling (minute + hour windows)
Parameter Validator	Whitelist, blacklist, type, range, and regex pattern checks

Why we built it

Dify maintainers have closed three governance-related issues as not_planned (#34021, #34100, #34687) — the position is clear: governance is not in Dify's product scope. This is understandable. Dify is the build layer.

This plugin provides the govern layer — as a native Dify plugin, not middleware, not a fork.

How to use it

Place before any sensitive tool in an agent workflow:

Agent Node (LLM decides) → [Trust Tier Check] → allowed? → Tool executes
                                                   → denied? → Log + alert

Links

• GitHub: https://github.com/deeparchi-ai/maea-trust-tier
• License: MIT
• Requires: Dify ≥ 1.14.0
• Part of: MAEA (Multi-Agent Enterprise Architecture) by DeepArchi

Would love feedback from anyone running Dify agents in production — especially around what policy dimensions we should add next (spend limits? HITL approval gates? cross-tenant isolation?).

[kuangmi-bit]

Update: We just shipped a companion plugin — MAEA A2A Bridge — that handles the other half of agent governance: agent-to-agent communication.

Three tools:

• a2a_send — bidirectional multi-turn messaging between Dify agents (not just Workflow-as-Tool)
• a2a_delegate — task delegation with timeout, token budget, and automatic fallback escalation
• a2a_discover — MAEA agent registry lookup by capability and trust tier

Together with the Trust Tier plugin (permission enforcement), this forms a complete governance layer on top of Dify:

• Trust Tier = what an agent may do
• A2A Bridge = which agents can collaborate and how

Both MIT. Both Dify-native plugins. Feedback welcome.

[kuangmi-bit]

Full stack update:

🔐 Trust Tier — github.com/deeparchi-ai/maea-trust-tier (permission enforcement)
🔗 A2A Bridge — github.com/deeparchi-ai/maea-a2a-bridge (agent communication)
🏢 Tenant Gateway — github.com/deeparchi-ai/maea-tenant-gateway (multi-tenant isolation, just released)

📄 Reference Architecture Doc — Dify + MAEA Enterprise Agent Governance — covers threat model, compliance mapping (EU AI Act / DORA / China AI regs), deployment topologies, and a 3-phase roadmap.

📝 Deep-dive article — #39217

All three plugins are MIT. All work without forking Dify. Feedback on what governance gaps to tackle next is welcome.