Feature  ·  Governance

Enforce policy where your agents actually run.

Policy as code compiles to a bundle your SDK evaluates in-process. Risky tool calls wait for a person. Every decision lands in an audit trail that names who made it.

Author in Git or in the dashboard. Pro plan and above, same gate as Guardrails.

Start free →View docs
Zespan Governance
Works withPolicy as codeSDK-local evaluationTool approvalsAudit logSOC 2 evidenceRBACSSO

in-process

enforcement

4

actor types

SOC 2

control evidence

1.0  Governance

Policy as code, or authored in the dashboard

What you get

zespan policy validate, plan, test, apply, and pullplan prints the exact change before apply writes it — no surprise deploysEach writer prunes only its own rows: Git and the dashboard cannot delete each other's

A policy is a versioned document — written as YAML in your repository, or drafted in the dashboard. Both compile through the same pipeline into the same guardrail rows, so a dashboard-authored policy reaches the SDK exactly like a Git-authored one.

Zespan guardrail rules deployed from a policy, showing type, phase, action, and enforcement

2.0  Governance

Enforced in your runtime, not on ours

What you get

Five rule types evaluate locally; the bundle names the rest under remoteTypes rather than pretending it saw the whole policyFails closed before the first bundle loads, and fails open afterwards — a control-plane blip cannot become a global false denyLocal verdicts are reported back, so an SDK enforcing quietly never looks like a policy with zero hits

The rules that are pure functions of the request — regex, secret egress, schema contract, model governance, topic boundary — compile into a bundle the SDK evaluates in-process. The call is refused inside your own service. Nothing proxies through Zespan, and no agent is rebuilt on our platform to earn the control.

3.0  Governance

A risky call waits for a person

What you get

Statuses: pending, approved, rejected, expired — an approval that never arrives is not an approvalRisk levels low through critical, with a configurable timeoutDistinct from a guardrail block: a block is a standing verdict, this is a one-time human decision

An action with real consequences pauses instead of proceeding. awaitApproval holds the tool call while a named reviewer decides in the dashboard, and the decision is recorded against them rather than against the agent that asked.

4.0  Governance

An audit trail that names the actor

What you get

Actor types: user, apiKey, system, superadmin — filterable, and exported in CSVSOC 2 controls CC6.1, CC7.2, and CC8.1, collected from live data rather than re-entered by handEvidence is what Zespan produces; it is not a certification

Every entry carries an actor type — a person, an API key, the system itself, or Zespan staff — so a scheduled job is never filed under whoever happened to trigger it. SOC 2 control evidence is assembled from that same trail and exports as JSON or HTML.

Setup

Under 5 minutes,
two lines of code.

No forking and no architecture changes. Traces appear within seconds of the first agent run, with cost attribution, eval scores, and anomaly alerts on by default.

typescript
import { Zespan, PolicyBundleStore } from '@zespan/sdk';

const lt = new Zespan({ apiKey: process.env.ZESPAN_API_KEY });

// Policies you applied with `zespan policy apply`, evaluated in-process.
const policies = new PolicyBundleStore({
  baseURL: 'https://api.zespan.com',
  apiKey: process.env.ZESPAN_API_KEY!,
  environment: 'production',
});
await policies.refresh();

const decision = policies.evaluate({ text: userMessage, phase: 'pre', model: 'gpt-4o' });
if (decision.kind === 'blocked') return { blocked: true, reason: decision.verdicts[0]?.reason };

// A tool call with real consequences waits for a named reviewer.
await lt.awaitApproval('refund.issue', { amount: 4000 }, { risk: 'high' });

Common questions

Do I have to rebuild my agents on Zespan to get enforcement?

No. Policies compile to a bundle your existing SDK evaluates in-process, so the block happens inside your own service. Zespan is not in the request path — there is no proxy or gateway to route through, and your agents keep whatever framework they already use.

What happens if Zespan is unreachable?

The SDK keeps evaluating the last bundle it successfully loaded, so a control-plane outage cannot turn into a global false deny. Before the very first bundle loads it fails closed instead — answering "allowed" at that point would be indistinguishable from a project with no policies at all.

Can every guardrail type be evaluated locally?

No, and the bundle says so. Regex, secret egress, schema contract, model governance, and topic boundary are pure functions of the request and run locally. An LLM judge needs a model call and a budget needs a shared counter, so those stay server-side and are listed under remoteTypes — the SDK calls out rather than assuming it saw the whole policy.

Is Zespan SOC 2 certified?

Zespan produces SOC 2 control evidence — CC6.1, CC7.2, and CC8.1 — collected from your live audit trail and exportable as JSON or HTML for your own auditors. That is evidence for your controls, which is not the same thing as Zespan holding a certification.

Do dashboard-authored guardrails reach the SDK bundle?

Only rules that came from a policy do. A hand-built guardrail is evaluated server-side, while policy-derived rules are the ones compiled into the bundle. That boundary is what lets the two writers coexist without either one pruning the other's rules.

Explore more features

All features →
TracingSee exactly what your agents are doing.Every LLM call, agent step, and tool invocation captured as a structured trace — with cost, latency, and tokens per span.Agent MonitoringKnow which agents are healthy, and which aren't.Composite health scores, delegation graphs, and per-agent cost attribution — built for systems with many cooperating AI agents.EvaluationsMeasure output quality on every trace, automatically.12 built-in LLM-as-judge templates run on every new trace with no setup. Track quality trends, catch regressions, and run manual eval campaigns.GuardrailsStop bad outputs before they reach users.7 guardrail types run inline on every LLM request — block, warn, redact, or log. PII, toxicity, topic drift, format, cost ceiling, and custom rules.

Your agents are running.
Do you know what they’re doing?

Observe, evaluate, guard, and control every agent, live in minutes. No credit card required.

Start free →Talk to us →
Free tier availableUnder 5 min setupNo credit card