Governance interceptor for tool calls and inter-agent messages (TealTiger integration)

[Naga Satish Chilakamarti (nagasatish007)]

Summary

Following up on Discussion #7726 (Governance Decision Receipts), I'd like to propose a concrete governance interceptor integration using TealTiger that implements the patterns discussed there — content-addressed action references, decision receipts, and vendor-neutral evidence.

Proposed Integration

Three governance layers, each independent:

1. Pre-execution hook — intercepts after agent decides to call a tool but before execution:

from autogen_tealtiger import TealTigerGuard

# Zero-config (observe mode)
guard = TealTigerGuard()

# With policies
from tealtiger import TealEngine
engine = TealEngine(policies=company_policies, mode="ENFORCE")
guard = TealTigerGuard(engine=engine)


2. Message interceptor — adds provenance metadata to inter-agent messages:

from autogen_tealtiger import TealTigerAuditAgent

agent = TealTigerAuditAgent("assistant", tool_guard=guard)


3. Post-execution receipt — structured audit binding tool call + policy decision + result:

Content-addressed params_hash (SHA-256 of JCS-canonicalized arguments, as discussed in #7726 by @chopmob-cloud)
decision_id linking pre-execution authorization to post-execution outcome
Vendor evidence in extensions["teec"] namespace (never validated by AutoGen)
Capabilities
Pre-tool-call policy evaluation (<5ms, deterministic, no LLM in governance path)
Per-agent tool allowlists in GroupChat scenarios
Cost tracking per agent in multi-agent conversations
Kill switch — freeze specific agent mid-conversation without stopping others
Decision receipts with expires_at, revalidate_if, supersedes (from #7726 discussion)
Works with register_reply interceptor pattern and GroupChat speaker_selection_method
GroupChat Example
from autogen_tealtiger import TealTigerGuard, TealTigerAuditAgent

guard = TealTigerGuard(engine=engine)
agent = TealTigerAuditAgent("assistant", tool_guard=guard)

group_chat = GroupChat(
    agents=[agent1, agent2],
    messages=[],
    speaker_selection_method=guard.governed_speaker_selection,
)


Relationship to #7726
This implements the patterns discussed in that thread:

Content-addressed action_ref → params_hash (SHA-256 of JCS-canonical params)
Two-record boundary (authorization before, outcome after) → GovernanceDecision + GovernanceOutcome
Revalidation triggers (policy version bump, scope expansion, budget change)
Vendor-neutral extensions passthrough

Context:
TealTiger — open-source AI agent security platform (Apache-2.0, NVIDIA Inception)
Published on PyPI (tealtiger v1.3.0) and npm (tealtiger-ai-sdk v0.1.0)
Covers 8/10 OWASP Agentic Security Index categories
Already integrated with LangChain, Vercel AI SDK, and CrewAI (governance contract PR approved)
All governance is deterministic and in-process — no external service, <5ms overhead


Contribution Plan
Once the package is on PyPI, I'd submit a PR adding:

An example under samples/ showing governance interceptor with GroupChat
Documentation for the register_reply-based governance pattern
Happy to align with the v0.4 architecture if that's the preferred target. Would appreciate guidance on whether to target microsoft/autogen or ag2ai/ag2 for this contribution.