What it protects, what it catches, and how to add the rest.

import { Agent } from 'agentfootprint';import { gatedTools, staticTools } from 'agentfootprint/providers';import { PermissionPolicy } from 'agentfootprint/security'; const policy = PermissionPolicy.fromRoles(  {    readonly: ['get_refund'],    support: ['get_refund', 'process_refund'],  },  'readonly', // the role for this request); const agent = Agent.create({ provider, model: 'mock', permissionChecker: policy }) // refused if called  .toolProvider(gatedTools(staticTools([getRefund, processRefund]), (name) => policy.isAllowed(name))) // hidden from the model  .build();

import { recordRun } from 'agentfootprint/observe';import { conversationRedaction } from 'agentfootprint/security'; const agent = Agent.create({  provider,  model: 'mock',  // The conversation, and the fields your own tools name.  redact: conversationRedaction({ patterns: [/ssn|email/i] }),})  .tool(lookup)  .build(); const recorder = recordRun(agent);await agent.run({ message: 'Look up Dana.' });const recording = recorder.toRecording(); // what you store or send

import { Agent, allow, type MessageMiddleware, type ToolMiddleware } from 'agentfootprint'; const SSN = /\b\d{3}-\d{2}-\d{4}\b/g; // The message, before the run commits it.const scrubSSNs: MessageMiddleware = {  name: 'scrub-ssns',  onMessage: (message) => {    const clean = message.content.replace(SSN, '[ssn]');    return clean === message.content ? allow() : allow(clean, 'masked an SSN');  },}; // Every tool result, before the model reads it, at any depth.const stripPII: ToolMiddleware = {  name: 'strip-pii',  onToolResult: (call) => {    const before = JSON.stringify(call.result);    const after = before.replace(SSN, '[ssn]');    return after === before ? allow() : allow(JSON.parse(after), 'masked an SSN');  },}; const agent = Agent.create({ provider, model: 'mock' })  .tool(lookup)  .act({ input: [scrubSSNs], afterTool: [stripPII] })  .build();

import { InMemoryStore, MEMORY_STRATEGIES, MEMORY_TYPES, defineMemory, type MemoryStore } from 'agentfootprint/memory'; const scrub = <T,>(value: T): T => JSON.parse(JSON.stringify(value).replace(/\b\d{3}-\d{2}-\d{4}\b/g, '[ssn]')); // Every way into the store goes through your filter. Extend RedisStore the same way.class ScrubbingStore extends InMemoryStore {  override put: MemoryStore['put'] = (identity, entry, options) => super.put(identity, scrub(entry), options);  override putMany: MemoryStore['putMany'] = (identity, entries, options) =>    super.putMany(identity, scrub(entries), options);  override putIfVersion: MemoryStore['putIfVersion'] = (identity, entry, expectedVersion, options) =>    super.putIfVersion(identity, scrub(entry), expectedVersion, options);  override recordSignature: MemoryStore['recordSignature'] = (identity, signature) =>    super.recordSignature(identity, scrub(signature));  override seen: MemoryStore['seen'] = (identity, signature) => super.seen(identity, scrub(signature));} const store = new ScrubbingStore();const memory = defineMemory({  id: 'recent',  type: MEMORY_TYPES.EPISODIC,  strategy: { kind: MEMORY_STRATEGIES.WINDOW, size: 10 },  store,});

import { Agent } from 'agentfootprint';import { openRecording, recordRun } from 'agentfootprint/observe';import { conversationRedaction } from 'agentfootprint/security'; // Walk the values, because the JSON form escapes quotes and newlines. Also catches text already encoded inside a string.const keepOut = (value: unknown, text: string): unknown => {  if (typeof value === 'string') return value.replaceAll(text, '[kept out]').replaceAll(JSON.stringify(text).slice(1, -1), '[kept out]');  if (Array.isArray(value)) return value.map((item) => keepOut(item, text));  if (value && typeof value === 'object') return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, keepOut(item, text)]));  return value;}; const agent = Agent.create({ provider, model: 'mock', redact: conversationRedaction() }).build();const recorder = recordRun(agent);const answer = String(await agent.run({ message: 'Summarize the case.' })); const recording = answer ? keepOut(recorder.toRecording(), answer) : recorder.toRecording(); // Fail closed: never store a recording that still holds the answer.if (answer && JSON.stringify(recording).includes(JSON.stringify(answer).slice(1, -1))) {  throw new Error('The answer is still in the recording.');} const artifacts = openRecording(recording as ReturnType<typeof recorder.toRecording>);

const acme = { tenant: 'acme', principal: 'ada', conversationId: 'thread-1' };const globex = { tenant: 'globex', principal: 'ada', conversationId: 'thread-1' }; await agent.run({ message: 'Our plan is Enterprise.', identity: acme }); // The same person and thread id under another tenant. Nothing carries over.await agent.run({ message: 'What is our plan?', identity: globex }); // Remove everything for one identity.await store.forget(acme);

const createTicket = defineTool({  name: 'create_ticket',  description: 'File a support ticket.',  inputSchema: { type: 'object', properties: {} },  needs: { credential: 'helpdesk' }, // what it needs, not the secret itself  execute: (_args, ctx) => postToHelpdesk(ctx.credential!.toHeaders()), // this tool, at this moment}); const agent = Agent.create({  provider,  model: 'mock',  credentials: staticTokens({ helpdesk: process.env.HELPDESK_TOKEN! }), // or vaultCredentials(), or your own})  .tool(createTicket)  .build();

import { Agent, checkInApproved, defineTool, isCheckInPause } from 'agentfootprint'; const issueRefund = defineTool<{ amount: number }, string>({  name: 'issue_refund',  description: 'Issue a refund to the customer.',  inputSchema: { type: 'object', properties: { amount: { type: 'number' } }, required: ['amount'] },  checkIn: (args) => args.amount > 1000, // a person decides on the big ones  execute: ({ amount }) => {    refunded.push(amount);    return `refunded ${amount}`;  },}); const agent = Agent.create({ provider, model: 'mock' }).tool(issueRefund).build(); const outcome = await agent.run({ message: 'Refund $5,000 on A-1042.' }); if (isCheckInPause(outcome)) {  // The tool has not run. Show the person outcome.checkIn: what it will do, what it read, what drove this.  const decision = checkInApproved({ request: outcome.checkIn, by: 'ada@ops' });  await agent.resume(outcome.checkpoint, decision);}

import { Agent, defineTool } from 'agentfootprint'; const searchOrders = defineTool({  name: 'search_orders',  description: 'Find a customer’s orders.',  inputSchema: { type: 'object', properties: {} },  execute: () => [{ orderId: 'A-1042' }],}); const getRefund = defineTool({  name: 'get_refund',  description: 'Look up a refund.',  inputSchema: { type: 'object', properties: { orderId: { type: 'string' } }, required: ['orderId'] }, // the wrong shape never runs  argumentsFrom: ['search_orders'], // its input should come from that tool  resultColumns: { orderId: 'string', amount: 'number' }, // what its rows should hold  execute: () => [{ orderId: 'A-1042', amount: 'a lot' }],}); const agent = Agent.create({ provider, model: 'mock', checkColumnTypes: 'warn' })  .tool(searchOrders)  .tool(getRefund)  .namesAndNumbersFromEvidence() // every name and number in the answer  .build(); // Findings from the model and from tools arrive on one stream.agent.on('agentfootprint.integrity.context_error', (event) => flagged.push(event.payload.kind)); // What the provider itself said, such as 'refusal' or 'content_filter'.agent.on('agentfootprint.stream.llm_end', (event) => stops.push(event.payload.stopReason));

import { Agent, allow, type ToolMiddleware } from 'agentfootprint'; // Your classifier, your rule. The library gives it the right moment.const quarantine: ToolMiddleware = {  name: 'quarantine',  onToolResult: (call) =>    looksLikeInjection(JSON.stringify(call.result)) // objects too, not just strings      ? allow('[removed: this text tried to give instructions]', 'looked like an injection')      : allow(),}; const agent = Agent.create({ provider, model: 'mock' })  .tool(readTicket)  .act({ afterTool: [quarantine] })  .build();

import { Agent, type PermissionChecker } from 'agentfootprint'; // Each tool is allowed on its own. This chain is not.const noExfiltration: PermissionChecker = {  name: 'no-exfiltration',  check: ({ target, sequence }) =>    target === 'send_email' && sequence?.some((call) => call.name === 'read_customer_file')      ? { result: 'halt', reason: 'security:exfiltration', tellLLM: 'This combination is restricted.' }      : { result: 'allow' },}; const agent = Agent.create({ provider, model: 'mock', permissionChecker: noExfiltration })  .tool(readCustomerFile)  .tool(sendEmail)  .build(); // The run ends with a PolicyHaltError you can catch, before the email goes out.

import { auditExport, verifyAuditBundle } from 'agentfootprint/observe'; const audit = auditExport({ agent: 'refunds' });const stop = agent.enable.observability({ strategy: audit });await agent.run({ message: 'Refund A-1042.' });stop(); const bundle = audit.bundle(); // plain JSON, store it anywhereconst check = verifyAuditBundle(bundle); // offline, with no agent// check.valid is true, and check.recordsChecked says how many records it read.// Change one byte anywhere, and valid is false, with brokenAt naming the record.