Most AI agent frameworks have no built-in governance. LangChain, CrewAI, and OpenAI Agents SDK all let you build powerful agents, but none of them log what the agent did, why it did it, or whether a human approved it.
Articles 9-15 of the EU AI Act require:
asqav adds governance to any Python AI agent in one decorator:
from asqav import audit
@audit
def my_agent_call(prompt):
return llm.invoke(prompt)
Every call gets a tamper-evident audit trail with:
pip install asqav
Open source, MIT licensed, no vendor lock-in.
]]>The @audit decorator from asqav wraps any Python function with a tamper-evident audit trail. No infrastructure changes, no database to manage.
def process_claim(claim_id):
analysis = llm.invoke(f"Analyze claim {claim_id}")
decision = llm.invoke(f"Approve or reject: {analysis}")
return decision
No record of what the LLM returned. No proof a human reviewed it. No way to reproduce the decision.
from asqav import audit
@audit
def process_claim(claim_id):
analysis = llm.invoke(f"Analyze claim {claim_id}")
decision = llm.invoke(f"Approve or reject: {analysis}")
return decision
Now every call is logged with:
The audit trail is tamper-evident. If anyone modifies a log entry, the signature breaks.
You can also block or flag actions in real-time:
from asqav import audit, policy
@policy(max_tokens=1000, require_approval=True)
@audit
def high_risk_decision(data):
return agent.run(data)
pip install asqav
MIT licensed. Source on GitHub.
]]>This is the practical checklist, focused on what engineering teams actually need to build. No legal jargon.