Back to Blog
Tutorial

Add AI Governance to Your Agent in 5 Minutes

A step-by-step guide to adding policy enforcement, PII detection, and compliance receipts to any AI agent.

February 11, 2026  ·  5 min read  ·  Tork Network

Why Governance Matters

Your AI agent is making API calls, processing user data, and executing tool calls. Without governance, there's nothing stopping it from leaking a customer's SSN to a third-party API or executing a destructive tool call in production. Governance isn't about compliance theatre — it's about making sure your agent does what you expect, every time, with proof.

Step 1: Install the SDK

Tork has SDKs for every major language. Pick yours:

# Python
pip install tork-governance

# JavaScript / Node.js
npm install tork-governance

SDKs are also available for Go, Rust, Ruby, PHP, .NET, Java, Kotlin, Swift, and Elixir. See the full documentation for all install commands.

Step 2: Get Your API Key

Sign up at tork.network/signup to get your API key. The free tier includes 5,000 API calls per month — no credit card required. Your key will look like tork_jwt_... or tork_live_....

Store it as an environment variable:

export TORK_API_KEY="tork_jwt_your_key_here"

Step 3: Add the Middleware

Wrap your agent's LLM calls with Tork's governance check. Here's how in Python and JavaScript:

Python

from tork_governance import Tork
 
tork = Tork(api_key=os.environ["TORK_API_KEY"])
 
# Before sending to the LLM, govern the input
result = tork.govern(
  content=user_message,
  policy="strict",
  direction="input"
)
 
if result.action == "block":
  raise Exception(result.reason)
 
# Use result.governed (PII-redacted) content
llm_response = call_llm(result.governed)

JavaScript

import { Tork } from 'tork-governance';
 
const tork = new Tork({ apiKey: process.env.TORK_API_KEY });
 
// Govern the input before sending to the LLM
const result = await tork.govern({
  content: userMessage,
  policy: 'strict',
  direction: 'input',
});
 
if (result.action === 'block') throw new Error(result.reason);
 
// Use result.governed (PII-redacted) content
const llmResponse = await callLLM(result.governed);

That's it. Every message now passes through Tork before reaching the LLM. PII is automatically detected and redacted, and policies are enforced.

Step 4: Configure Policies

Tork ships with sensible defaults, but you can customise policies to match your requirements. Here's a simple policy config:

// tork.config.json
{
  "policy": "strict",
  "pii": {
    "enabled": true,
    "action": "redact",
    "types": ["email", "ssn", "credit_card", "phone"]
  },
  "blocked_tools": ["shell_execute", "file_delete", "send_email"],
  "require_human_approval": ["database_write", "payment_process"]
}

Policies can be strict (block on any violation), standard (warn and log), or minimal (log only). You can also define custom per-tool rules.

Step 5: Check Your Dashboard

Once your agent starts making governed calls, head to your Tork dashboard. You'll see:

What You Get Out of the Box

Next Steps

Tork Network Pty Ltd — Sydney, Australia