Gate AutoGen tool calls before they run.
decionis-autogen wraps a AutoGen tool so each call asks Decionis first, with the call's own arguments, and the tool runs only on a verdict that allows it. The agent sees the same tool: its name, description and argument schema do not change.
- PyPI
- decionis-autogen 0.2.0
- License
- MIT
- Python
- 3.10+
- Source
- not public
- Checked
- 2026-09-26
Install
It depends on the decionis SDK (0.2.0, MIT), which pip installs with it. The client needs an organization API key and its tenant id.
pip install decionis-autogen
pip install 'decionis-autogen[legacy]'- AutoGen Core 0.4 to 0.7 (autogen-core >=0.4,<0.8)
- The legacy AutoGen 0.2 UserProxyAgent hook on Python 3.10 to 3.12 (autogen-agentchat >=0.2.36,<0.3)
Wrap a tool
from autogen_core.tools import FunctionTool
from decionis import DecionisClient
from decionis_autogen import guard_tool
refund_tool = FunctionTool(send_refund, description="Issue a customer refund.")
guarded_refund = guard_tool(
inner_tool=refund_tool,
client=DecionisClient(api_key="..."),
tenant_id="your-org-uuid",
workflow_key="refund_execution",
site_base_url="https://decionis.com",
)
agent = AssistantAgent(..., tools=[guarded_refund])guard_tool wraps an AutoGen Core BaseTool: its run() asks Decionis first and only then delegates to the inner tool's run_json, with the inner tool's name, description and argument schema unchanged. For AutoGen 0.2, DecionisUserProxyAgent overrides execute_function and a_execute_function the same way.
What each verdict does
Enforcement
ALLOW runs the tool. BLOCK, REVIEW_REQUIRED, ESCALATE and ERROR raise DecionisToolRefusal before it runs, carrying the Decision Dossier id and, when there is one, its verify link.
Shadow
With shadow_mode=True the decision is still asked for and recorded, and the tool runs whatever the verdict: start here, and remove it once the verdicts match the policy you meant.
When Decionis cannot be reached
A timeout after retries, an HTTP error or no connection. In shadow, the tool runs anyway: the adapter logs a warning and passes the failure to on_decision as error, with decision=None. In enforcement, the error is raised and the tool does not run.