Back to Blog
Tutorial

Add AI Governance to Your Agent in 5 Minutes

A step-by-step guide to adding policy enforcement, PII detection, and compliance receipts to any AI agent.

February 11, 2026  ·  5 min read  ·  Tork Network

Correction — 3 August 2026

This post was published in February 2026 and described one product where there are in fact two. The code samples below have been corrected in place, because a snippet that does not run helps nobody. The claims about what you will see in your dashboard have been corrected here rather than rewritten above.

tork-governance (the pip install / npm install lines in Step 1) is the on-device family. tork-governance makes the governance decision on your machine. PII detection, redaction and the returned verdict are computed on-device. With no API key it makes zero network calls: prompts, completions and detected PII values never leave the machine, and nothing appears in your dashboard.

Supply an API key and the SDK additionally reports a metadata-only attestation of each decision — the action taken, PII type labels and counts, a risk classification, policy labels and a salted fingerprint. It never sends input text, output text or PII values. The decision itself is still made on-device and is never delayed or changed by reporting. Those attestations appear in your dashboard and are included in the daily on-chain anchor — each one recorded as a client attestation (capture_mode=edge, attested_by=client), a claim Tork recorded but did not execute and cannot independently verify. Requires tork-governance 0.24.0+ (PyPI) or 0.11.0+ (npm).

A decision reported by an on-device SDK is recorded as a client attestation (capture_mode=edge, attested_by=client): a claim Tork recorded but did not execute and cannot independently verify. A decision made by @torknetwork/sdk is recorded as capture_mode=cloud, attested_by=tork — Tork made that call itself. Both are equally immutable once anchored; they differ in what is immutable. A client attestation freezes your claim. A server-governed receipt freezes Tork's own decision.

The original Step 5 below implied that installing the SDK would populate your dashboard. It does not on its own. Local governance is free and unlimited — decisions made on your own machine are never metered. Evidence is what is metered: attestations, receipts and anchoring.

Why Governance Matters

Your AI agent is making API calls, processing user data, and executing tool calls. Without governance, there's nothing stopping it from leaking a customer's SSN to a third-party API or executing a destructive tool call in production. Governance isn't about compliance theatre — it's about making sure your agent does what you expect, every time, with proof.

Step 1: Install the SDK

Tork has SDKs for every major language. This tutorial uses the on-device family — tork-governance, which decides on your machine. Pick yours:

# On-device family — decides locally, entry class `Tork`

# Python
pip install tork-governance

# JavaScript / Node.js
npm install tork-governance

SDKs are also available for Go, Rust, Ruby, PHP, .NET, Java, Swift, and Elixir. See the full documentation for all install commands.

If what you want is a receipt recording Tork's own decision rather than your attested claim, install the cloud package instead — npm install @torknetwork/sdk. It uses a different entry class (TorkClient), sends content to Tork, and Tork makes the decision server-side. The two families are not interchangeable: tork-governance has never exported TorkClient.

Step 2: Get Your API Key

Sign up at tork.network/signup to get your API key. The free tier includes 5,000 API calls per month — no credit card required. Your key will look like tork_live_....

Correction, 3 Aug 2026: this step is optional for the on-device package. tork-governance governs with no API key at all — and with no key it makes zero network calls. A key is only what would let it report evidence, and reporting is not in the currently published builds. See the correction note at the top.

Store it as an environment variable:

export TORK_API_KEY="tork_live_your_key_here"

Step 3: Add the Middleware

Wrap your agent's LLM calls with Tork's governance check. Here's how in Python and JavaScript:

Python

from tork_governance import Tork
 
# No api_key = fully local, zero network calls
tork = Tork()
 
# Before sending to the LLM, govern the input.
# govern() is synchronous and decides on-device.
result = tork.govern(user_message)
 
if result.action == "deny":
  raise Exception("blocked by policy")
 
# result.output is the PII-redacted text
llm_response = call_llm(result.output)

JavaScript

import { Tork } from 'tork-governance';
 
// No apiKey = fully local, zero network calls
const tork = new Tork();
 
// Govern the input before sending to the LLM.
// govern() is synchronous — do not await it.
const result = tork.govern(userMessage);
 
if (result.action === 'deny') throw new Error('blocked by policy');
 
// result.output is the PII-redacted text
const llmResponse = await callLLM(result.output);

That's it. Every message now passes through Tork before reaching the LLM. PII is automatically detected and redacted, and policies are enforced — all of it computed on your own machine, with nothing sent anywhere.

Step 4: Configure Policies

Tork ships with sensible defaults, but you can customise policies to match your requirements. Here's a simple policy config:

// tork.config.json
{
  "policy": "strict",
  "pii": {
    "enabled": true,
    "action": "redact",
    "types": ["email", "ssn", "credit_card", "phone"]
  },
  "blocked_tools": ["shell_execute", "file_delete", "send_email"],
  "require_human_approval": ["database_write", "payment_process"]
}

Policies can be strict (block on any violation), standard (warn and log), or minimal (log only). You can also define custom per-tool rules.

Step 5: Check Your Dashboard

Correction, 3 Aug 2026: as originally written, this step was wrong for the on-device package. A receipt produced by tork-governance is a local object returned to your code. It does not appear in your dashboard and is not anchored unless it is reported — which requires an API key and tork-governance 0.24.0+ (PyPI) or 0.11.0+ (npm), both published 3 Aug 2026. When it is reported, it is recorded as a client attestation, not as a decision Tork made or verified. The dashboard view described below is what the cloud path (@torknetwork/sdk) gives you today.

Once your agent starts making governed calls through the cloud path, head to your Tork dashboard. You'll see:

What You Get Out of the Box

Next Steps

Tork Network Pty Ltd — Sydney, Australia