SHACKLE: fail-closed governance standard for autonomous AI agents

Dante Bullock, a 52-year-old self-taught systems architect from Oakland, California, built SHACKLE out of necessity. He audited issue trackers in CrewAI, AutoGen, and LangGraph to map the exact systemic failures affecting developers in production—real-time web scraping and community sentiment mining identified the root cause: agents without native circuit breakers or spending controls. The result is SHACKLE, published June 17, 2026, shipped with no venture capital and no corporate incubator.

SHACKLE operates as a lightweight governance layer that sits inside your runtime via dynamic Python shims. It intercepts LLM calls and tool execution client-side, monitoring execution state deterministically. The core invariant is that cost is read from usage after each call, so SHACKLE halts the loop, not the single call that crossed the line. When an agent breaches your boundaries—identical sequential tool calls, error cascades, budget overrun, or execution timeout—SHACKLE trips the circuit breaker and drops you into an interactive terminal console with Resume / Skip / Abort options.

The system ships as SP/1.0 (SHACKLE Protocol 1.0), a conformance standard with three layers of certification. SP/1.0-Core verifies that every mediated action resolves to the correct ALLOW / DENY / HITL verdict with the correct deny reason. SP/1.0-HITL adds proof that rejected and deferred actions cannot execute by being replayed, covering all five human-in-the-loop transitions: approve, reject, modify, defer-escalate, and duplicate-resume. SP/1.0-Sovereign adds atomic daemon state, tamper-evident ledgering, and audit export for enterprise accountability. Certification is measured entirely against 15 hash-verifiable fixtures (fixtures/conformance.json)—10 decision-core cases plus 5 HITL transition cases—and a stdlib-only reference implementation (shackle/conformance.py). The same vectors that certify a runtime are the ones anyone else can re-run to check the claim; there is no private audit or pay-to-pass seal. Verified runtimes appear in the public SHACKLE Conformance Registry with the level achieved, SP/1.0 version, and date.

Integrations ship first-class: a LiteLLM guardrail (shackle/litellm_shackle_guardrail.py) enforces SP/1.0 on any LiteLLM-powered agent (CrewAI, AutoGen, LangGraph, custom), and an AutoGen wrapper (shackle/autogen_shackle_wrapper.py) wraps tool calls through the same engine. Because LiteLLM sits under most agent frameworks, the guardrail governs them through a single chokepoint. Installation is one line: pip install -e . from source or pip install pyshackle from PyPI. Guarding a workflow requires one decorator: @Guard(budget=0.25, max_repeat_calls=3, timeout_seconds=180). SHACKLE is purpose-built for local development, debugging, CLI agents, cross-framework coverage, and budget enforcement during iterative testing; for headless production APIs where blocking for human input is not an option, Bullock recommends considering framework-native solutions like TokenCircuit for automated LangGraph overrides.

AI agents have matured in capability but remain brittle in error handling. Frameworks like CrewAI, AutoGen, and LangGraph lack native, framework-agnostic spending guardrails or deterministic loop breakers. The result is a systemic failure mode: when an agent hits an unhandled tool error, it does not self-correct but instead enters a retry spiral, exhausting context and incurring runaway API costs. Bullock's response was to build SHACKLE not as a proposal but as a working standard—a conformance spec backed by executable tests and a reference implementation that can be independently verified.

The core insight of SP/1.0 is that a runtime's conformance cannot be asserted; it must be proven. The standard defines three things: a decision surface with three and only three verdicts (ALLOW / DENY / HITL), a conformance model grounded in set theory (Valid(τ) ⇔ Required(τ) ⊆ Supported(τ)), and a critical invariant that history-visible does not equal runtime-executable—meaning a rejected or deferred action that re-enters the loop is denied again, not waved through on replay. These principles close a class of failures where agents "resume" past their own guardrails. Because the fixtures are public, the reference implementation is stdlib-only, and the certification process is open to any framework, SHACKLE functions as a neutral arbiter: buyers and regulators can verify in minutes, from a clean clone, that an autonomous system does what it claims.

No comments yet. Be the first to share your thoughts!