Loading…
Adapter
Gate AutoGen tool calls before they run.
decionis-autogen wraps a AutoGen tool so each call asks Decionis first, with the call's own arguments, and the tool runs only on a verdict that allows it. The agent sees the same tool: its name, description and argument schema do not change.
- PyPI
- decionis-autogen 0.1.0
- License
- MIT
- Python
- 3.10+
- Source
- not public
- Checked
- 2026-09-26
Install
It depends on the decionis SDK (0.2.0, MIT), which pip installs with it. The client needs an organization API key and its tenant id.
pip install decionis-autogen
pip install 'decionis-autogen[legacy]'- AutoGen Core 0.4 to 0.7 (autogen-core >=0.4,<0.8)
- The legacy AutoGen 0.2 UserProxyAgent hook on Python 3.10 to 3.12 (autogen-agentchat >=0.2.36,<0.3)
Wrap a tool
from autogen_core.tools import FunctionTool
from decionis import DecionisClient
from decionis_autogen import guard_tool
refund_tool = FunctionTool(send_refund, description="Issue a customer refund.")
guarded_refund = guard_tool(
inner_tool=refund_tool,
client=DecionisClient(api_key="..."),
tenant_id="your-org-uuid",
workflow_key="refund_execution",
site_base_url="https://decionis.com",
)
agent = AssistantAgent(..., tools=[guarded_refund])guard_tool wraps an AutoGen Core BaseTool: its run() asks Decionis first and only then delegates to the inner tool's run_json, with the inner tool's name, description and argument schema unchanged. For AutoGen 0.2, DecionisUserProxyAgent overrides execute_function and a_execute_function the same way.
What each verdict does
Enforcement
ALLOW runs the tool. BLOCK, REVIEW_REQUIRED, ESCALATE and ERROR raise DecionisToolRefusal before it runs, carrying the Decision Dossier id and, when there is one, its verify link.
Shadow
With shadow_mode=True the decision is still asked for and recorded, and the tool runs whatever the verdict: start here, and remove it once the verdicts match the policy you meant.
When Decionis cannot be reached
The request raises (a timeout after retries, an HTTP error, no connection), and the adapter does not catch it: the tool does not run, in shadow as well as in enforcement.