An AI governance framework for LLM agents

A policy document is not a framework. A framework is the set of controls that execute on every model call, whether or not anyone is watching:

• Authorization — which code paths may invoke a model, and under whose identity.
• Budget — a hard ceiling per call, per request, and per tenant, enforced before the spend happens rather than reported after it.
• Failure containment — timeouts, bounded retries, and circuit breakers so a degraded provider cannot cascade into your whole system.
• Verdicts and witnesses — a decision attached to every output: accepted, rejected, or escalated for review.
• Evidence — a tamper-evident receipt chain you can hand an auditor, a customer, or your own incident review.

The common approach is to route model traffic through a gateway. It is easy to install and it does capture tokens and latency — but a proxy only ever sees HTTP. It does not know which user triggered the call, which business rule chose the branch, or what the caller intended the output to be used for. That context is exactly what governance decisions depend on.

Source-level wrapping puts the control at the call site. Intent is captured where it exists, policy travels with the code through code review, and no team can route around the gateway because there is no gateway to route around. It also removes a network hop and a vendor from your critical path.

Bestowal is a single zero-dependency file that injects these controls directly into your source: circuit breakers, retry and timeout guards, budget enforcement, witnesses, verdicts, and a signed, hash-chained receipt for every AI call. Its 76 layers group into 10 pillars and 25 Crown Jewels — together the enforcement surface of a full governance framework rather than a logging library.

You buy it once, read all of it, and own the file. There is no agent to run, no dashboard to subscribe to, and nothing that phones home.

See the 25 Crown Jewels · Try it on your own code

Governance fails when it arrives all at once. In practice this order gets adopted:

1. Wrap one high-traffic model call and emit receipts only — change no behavior.
2. Turn on timeouts and bounded retries once you can see the real failure distribution.
3. Add per-call and per-tenant budget ceilings using the spend the receipts revealed.
4. Add circuit breakers on the providers that actually degrade.
5. Add witnesses on the small number of actions that are expensive to get wrong.
6. Extend the same wrapper to the remaining call sites.

Prompt-injection filtering gets the attention, but the failures that reach production are usually mundane: an unbounded retry loop, a tool call with no spend ceiling, an agent action nobody can reconstruct afterward. A governance framework that enforces budgets, containment, and evidence covers those directly — and gives you the audit trail you need when a security question does arrive.