Sudhendra Seshachala Releases Conduct for Open-Source AI Agent Governance

Sudhendra Seshachala has released Conduct, an open-source governance framework designed to secure how AI agents execute tool calls. The project aims to replace reactive monitoring with a proactive security layer for Large Language Models (LLMs) and the Model Context Protocol (MCP).

Conduct operates on a "fail-closed by default" security model, meaning tool execution is blocked unless explicitly permitted by a verified policy. To achieve this, the framework utilizes a suite of components including a Router that acts as an LLM proxy, a playbook engine for managing permissions, and a canvas UI. According to the project's GitHub repository, the framework also ships with over 20 compliance packs to help teams standardize their agentic guardrails.

The Shift to Proactive Control

As AI agents transition from simple chat interfaces to autonomous entities capable of interacting with external systems, the industry has relied heavily on runtime firewalls. These traditional systems typically log violations after they occur, providing a forensic trail rather than a preventative barrier. Conduct shifts this paradigm by requiring signed policies and a verified chain of authority before any tool call is executed, ensuring that agents cannot perform unauthorized actions in the first place.

Why AI Governance as Code Matters

This approach introduces the concept of "AI Governance as Code," allowing development teams to treat agent permissions with the same rigor as infrastructure or security policies. By integrating directly with the Model Context Protocol (MCP), Conduct addresses a critical gap in the expanding ecosystem of LLM-powered tools. As MCP becomes a standard for how models access data and tools, having a verifiable layer of authority prevents the "black box" problem where agents might execute harmful or unintended commands without oversight.

The Path Forward

With the release of the Router and playbook engine, the focus now shifts to how organizations will integrate these signed policies into their existing CI/CD pipelines. While the framework provides the necessary infrastructure for proactive control, the broader industry must still determine the standard for the "compliance packs" that will define safe agent behavior across different sectors. For now, Conduct provides a blueprint for teams seeking to move beyond post-facto reporting toward a strictly governed agentic environment.