CAGE-lite open-source tool gates AI agent business actions

CAGE-lite is an open-source Python implementation of the CAGE framework (Control, Assurance, and Governance Evaluation), which was introduced in a broader paper called CAGE-1. The project started with a simple premise: before an AI agent's proposed action becomes a binding business consequence—a payment, access grant, transaction approval, system-of-record update, or disclosure of protected information—an organization must verify that the action is authorized and supported by the required evidence.

The tool works by introducing a final assurance checkpoint at the "business consequence boundary." When an agent proposes an action, CAGE-lite evaluates signals from identity systems, access controls, policies, and approval workflows. The action then enters one of two states: HELD (the action is blocked and does not execute, producing NO_BIND proof) or ADMITTED (the action is allowed to execute, producing BOUND proof). Each decision is recorded in a CAGE Warrant, a structured artifact containing decision proof, effect proof, evidence references, replay linkage, and integrity information. The Warrant distinguishes between deciding an action may proceed and proving what happened after that decision.

The included demo showcases a held-to-admitted replay scenario. A vendor payment of USD 75,000 exceeds the agent's direct standing limit of USD 50,000. Without the required human approval, CAGE holds the action with a boundary state of HELD, effect of NO_BIND, and system-of-record status of NOT_WRITTEN. When the action is replayed after approval evidence is added—with the action amount, standing limit, and policy unchanged—the replay is admitted, the effect is allowed to bind, and the original held Warrant remains preserved and linked to the replay Warrant. This provides a complete audit trail.

CAGE-lite is a v1 product preview (Python package version 0.1.2, CAGE Warrant schema 0.4). Installation is straightforward: Python 3.10 or later is required, and the package is available on PyPI. A live hosted dashboard allows inspection of boundary decisions, CAGE Warrants, replay linkage, and effect proofs without local installation. The source includes examples demonstrating individual behaviors: payment policy evaluation that produces a held decision, blocking an action without execution, adding required approval to admit and execute, and narrowing a requested payment to the agent's permitted scope. CAGE-lite does not replace agent runtimes, identity and access management, policy engines, guardrails, gateways, approval systems, observability platforms, or evaluation frameworks; instead, it consumes signals from those systems and evaluates whether a proposed action should be allowed to cross the business consequence boundary.

CAGE-lite addresses a fundamental challenge in deploying AI agents in high-stakes settings: the gap between what an agent proposes and what an organization is willing to execute. Before an agent can release funds, grant system access, or update a critical record, a decision must be made and proven. The framework splits this into two outcomes—HELD (action blocked, no binding effect) or ADMITTED (action allowed, effect executed)—and records both the decision and its proof in a structure called a CAGE Warrant. This enables auditability: an organization can show not only that an action was blocked or allowed, but why, what evidence was used, and what the resulting business effect was.

The demo case—a USD 75,000 payment against a USD 50,000 agent limit—illustrates the practical need. An agent capable of proposing actions exceeding its own authority must have a way to escalate or hold pending additional approval. CAGE-lite formalizes this boundary. Notably, the framework is designed to sit alongside existing infrastructure (runtimes, policy engines, approval workflows) rather than replace it, making it easier to integrate into deployed systems.

No comments yet. Be the first to share your thoughts!