// PACT governance — D/T/R addressing, envelopes, clearance, governed agents, MCP governance, verification gradient. Custom authz BLOCKED.
[HINT] Download the complete skill directory including SKILL.md and all related files
| name | 29-pact |
| description | PACT governance — D/T/R addressing, envelopes, clearance, governed agents. Custom authz BLOCKED. |
Quick reference for PACT organizational governance patterns.
pip install kailash-pact # Governance framework
pip install kailash>=2.0.0 # Core SDK with trust subsystem
pip install kailash-kaizen>=2.0.0 # For governed Kaizen agents
| Skill | Use When |
|---|---|
| pact-quickstart | Getting started, first GovernanceEngine |
| pact-governance-engine | Engine API, verify_action, compute_envelope |
| pact-dtr-addressing | D/T/R grammar, Address parsing |
| pact-envelopes | Three-layer model, monotonic tightening |
| pact-access-enforcement | 5-step algorithm, clearance, bridges, KSPs |
| pact-governed-agents | PactGovernedAgent, @governed_tool |
| pact-kaizen-integration | Wrapping Kaizen agents with governance |
| pact-mcp-governance | MCP tool governance: enforce, audit, middleware |
| pact-conformance-features | N1-N6: KnowledgeFilter, EnvelopeCache, PlanSuspension, AuditTiers, ObservationSink, cross-SDK vectors |
from pact.governance import GovernanceEngine, GovernanceVerdict
from kailash.trust.pact.config import (
ConstraintEnvelopeConfig, OrgDefinition,
TrustPostureLevel, VerificationLevel,
ConfidentialityLevel,
)
from kailash.trust.pact.agent import PactGovernedAgent
from kailash.trust.pact.audit import AuditChain
# MCP governance
from pact.mcp import (
McpGovernanceEnforcer, McpGovernanceMiddleware, McpAuditTrail,
McpToolPolicy, McpGovernanceConfig, McpActionContext,
)
Five canonical posture levels with autonomy gradient:
| Canonical | Autonomy | Ceiling | Old Name (alias) |
|---|---|---|---|
| PSEUDO | 1 | PUBLIC | PSEUDO_AGENT |
| TOOL | 2 | RESTRICTED | (new, no old) |
| SUPERVISED | 3 | CONFIDENTIAL | SHARED_PLANNING |
| DELEGATING | 4 | SECRET | CONTINUOUS_INSIGHT |
| AUTONOMOUS | 5 | TOP_SECRET | DELEGATED |
Old names work as enum aliases (TrustPostureLevel.PSEUDO_AGENT resolves to PSEUDO). String deserialization of old values is handled by _missing_().
See .claude/rules/pact-governance.md for security invariants.