Built with the limits visible.

The Bot Club

AgentGuard is built by The Bot Club Pty Ltd — an Australian company (ABN 99 695 980 226) developing open source for agent policy evaluation, local contracts, and explicit assurance boundaries.

The Bot Club ships Tribunal for coding-agent governance, AgentGuard for local agent action-control research and compatibility paths, and Evidencely for AI-powered accounting automation.

Why this exists

Agent actions become difficult to control when the calling process also retains the raw tool, credential, or socket. AgentGuard exists to test a narrower design: the agent sees a mediated tool while a separately owned local broker alone holds the raw capability.

The project does not claim broad market coverage or an exclusive integration position. It is concentrating on one reproducible OpenClaw-to-MCP-stdio path before expanding the scope.

On 1 May 2026, APRA wrote to industry describing observed gaps in AI governance and risk management. That public letter is context for operators; it is not evidence that AgentGuard satisfies a standard or will produce a compliance outcome.

The current reader is a technical founder or operator evaluating whether one private, local action boundary can be made deterministic, non-bypassable within its stated host limits, and independently reproducible.

Where we are

• v0.11.0 — historical metadata release. Compatibility adapters only; not executor-owned firewall proof.
• v0.11.2 — historical. Fail-open strict: false is a hard startup error. Named GitHub file-write intercept is documented on the proof page as configured intercept, not isolation.
• v0.11.3 — historical. Adapters evaluate through /api/v1/evaluate; contracts entry point ships; telemetry opt-in.
• v0.12.0 — historical. The budgets policy block is now enforced; it was accepted and ignored in every earlier release, so a policy that was silently over budget will start refusing actions. Rate-limit counters are storable across a restart and no longer leak, and require_approval is refused rather than passed through when no approval surface is configured.
• v0.13.0 — historical. The targets policy block is now enforced; it was accepted and ignored in every earlier release, so a policy scoped to named agents applied to every agent. An agent a policy does not target is now refused rather than handed the policy default. A held action with no approval surface is refused with 403 instead of a 202 that invited the caller to poll a gate that would never resolve. Token and spend budgets gained a reporting path, so they enforce against usage the caller reports.
• v0.14.0 — historical. policyAppliesTo() lets a caller ask whether a policy governs it before targets starts refusing; a block that matched nothing was previously indistinguishable from a policy that blocks everything. riskScore became one formula — the offline path had hard-coded the medium multiplier, so a critical session scored half what the same policy scored online.
• v0.15.0 — current npm and PyPI. Rate-limit counters are namespaced by policy. They were keyed by rule id alone, so one engine holding two policies that both named a rule shared a single counter and one policy's traffic throttled the other's. Counters reset once on upgrade, and a rate-limit snapshot taken before this release no longer applies. The API service also stopped keeping its own copy of the evaluation algorithm, so budgets, targets and riskScore are enforced there on the same code path as everywhere else.
• Live SDKs on npm and PyPI under BSL 1.1.
• Firewall-proof status: pending. The intended MCP-stdio broker must hold the raw capability outside OpenClaw and pass the registered bypass probes before a stronger claim is available.

Working with us

Current conversations are technical evaluations, not paid offers, service commitments, or readiness assessments. If you want to inspect the narrow action path and its limitations, book a 30-minute technical evaluation. We’ll start with the exact capability, caller identity, bypass paths, and evidence you can verify.

Who's writing this

Hani Koshaji — founder, The Bot Club, and maintainer of the AgentGuard project. Reach me at hani@thebot.club or on LinkedIn.