Artificial Intelligence 4 min read 1h ago

Conduct: Open-Source AI Agent Guardrails

Conduct is an Apache 2.0 open-source project that enforces AI agent policies before LLM calls and MCP tool invocations execute, using signed configuration and a SHA-256
The repository ships with more than twenty compliance packs covering OWASP, HIPAA, PCI DSS 4.0, EU AI Act, NIST AI RMF, and ISO 42001, plus twenty-two pre-built workflow playbooks.
A free Discovery mode provides fourteen days of read-only visibility into team AI activity, with a hosted commercial tier and self-hosted Docker Compose or Kubernetes options also

A new open-source project called Conduct is positioning itself as a pre-action governance layer for AI agents, intercepting LLM calls and shell tool invocations before they execute rather than logging them after the fact. Released under the Apache 2.0 licence, the project comprises two components — Conduct Guard and Conduct Router — governed by a single shared policy file deployable across an entire team's AI sessions.

How it works

Conduct Guard acts as the policy engine, applying block, warn, audit, or inject decisions to every AI action. It operates at three enforcement points: a CLI hook covering tools such as Claude Code, Cursor, Copilot, and Codex; the MCP layer for tool invocations; and Conduct Router, an LLM proxy through which any provider SDK — Anthropic, OpenAI, or Perplexity — can be routed. The project distinguishes itself from runtime observability tools by acting before the action executes rather than after, a distinction its developers frame as governance rather than monitoring.

Configuration integrity is enforced through a workspace-signed policy pack; Guard verifies the signature before applying any rule, and a tampered or unsigned pack is rejected. Audit decisions are recorded in a SHA-256 hash-chained log rooted at workspace creation, which the project claims allows one-click verification. Any missing or altered entry is said to break the chain. Cryptographic receipts for AI code checks have drawn growing interest across the industry, and Conduct adopts a comparable approach to audit integrity.

Ad Unit · 728×90 / Responsive

Compliance coverage

More than twenty compliance packs ship in the repository, covering OWASP, SOC 2 CC7.3, HIPAA §164.312, PCI DSS 4.0, EU AI Act Articles 15 and 16, NIST AI RMF, and ISO 42001, alongside framework-specific packs for Python, Node, and Terraform. Twenty-two pre-built playbooks are included — covering workflows such as issue-to-pull-request, incident response, production deploy gating, and CI/CD triage — each delivered as a single editable YAML file.

Discovery mode and deployment

A free Discovery mode offers fourteen days of read-only visibility into a team's AI actions without requiring any policy authoring or upstream installation. Rules can subsequently be promoted directly from what Discovery observed. The project can be self-hosted via Docker Compose or Kubernetes, with deployment templates provided in the repository. A hosted control plane at conductai.ai offers a free tier for Discovery and paid tiers that unlock enforcement, Router access, and hash-chain verification via API. The hosted platform is described as a commercial offering built on top of the open-source repository.

Licensing and trademarks

The entire codebase — including the CLI, Guard, Router, playbooks, and compliance packs — is released under Apache 2.0, which includes an explicit patent grant from contributors. Redistribution requires the licence and notice files to be preserved. The names Conduct, Conduct AI, and Conduct Guard remain trademarks of Conduct AI and are not covered by the open-source grant.

As MCP protocol security becomes an increasing concern for teams deploying autonomous agents, pre-action enforcement tools of this kind — capable of governing both LLM calls and shell-level tool invocations under a single auditable policy — represent a materially different posture from the post-hoc observability approaches that have dominated the space to date.

Topics

AI GovernanceAI SecurityOpen-Source Software

Organizations

Conduct AI

Ad Unit · 300×250 / Responsive