For developers

Wire ArtzAIn into your agent stack.

ArtzAIn is the model-agnostic agent control plane. CogNEXUS Labs builds it. artzain is the Python client you install to talk to it; @cognexuslabs/artzain is the TypeScript client on npm.

Install the SDK and get governed decisions in your loop today. Connect it to a control plane in your VPC when you go to production: same API, your policies, your perimeter.

SDK free to install Same API in your VPC Fail-closed · inline Signed decision records

~/agent-stack

$pip install artzain

# signup + starter integration

$artzain quickstart

# existing account

$artzain login

# TypeScript client (Node ≥ 18)

$npm i @cognexuslabs/artzain

# run the whole engine in your boundary

$artzain local up

Run it in your boundary → the self-serve install: engine + dashboard on your own machine, 30-day trial, no account.

Quickstart

A first call, and the decision it returns.

# gate a proposed action before it runs
import json
import artzain

name = "refund_order"
args = {"order": "MS-4821", "amount_usd": 4200}

try:
    d = artzain.decide(
        action=name,
        target="order:MS-4821",
        payload=json.dumps({"tool": name, "arguments": args}, ensure_ascii=False),
        kind="tool_call",
        agent_did="refund-orchestrator",
    )
except artzain.DecisionError:
    d = {"outcome": "deny"}  # the engine did not decide: fail closed

if d["outcome"] == "allow":
    dispatch(name, args)  # only allow runs the tool

Sealed decision

{
  "outcome": "allow",
  "decision_id": "01M2DTBGRR…",
  "audit_block_id": "7d8882…",
  "contributing_agents": [
    {"name": "tool-call-contract",
     "verdict": "allow", …},
    …
  ],
  "policy_bundle_version":
    "starter-policies:0.1.0",
  "resolution_policy":
    "bundle/starter-policies:0.1.0",
  "latency_ms": 142,
  "reasons": []
}

With a key from artzain login, the decision is sealed into the signed ledger before it returns, and audit_block_id names that leaf. With no key, decide() runs the local guards only: audit_block_id is null and nothing is sealed.

Interactive architecture

Watch a request flow through the stack.

Enterprise agent architecture on AWS, with ArtzAIn as the two decision chokepoints. Trace a sample (from a human or another system) layer by layer to allow, deny, or review. A kill-switch event (trip_global() → AgentKilledError) is a distinct object, not a fourth verdict. With an API key, every decide() outcome is sealed into a signed decision record before the response returns.

Clients
Web / Mobile Appbrowser · REST · WebSocket
API Client / CI-CDinternal tools · scheduled jobs
Edge
CloudFrontCDN · TLS · geo-block
AWS WAFIP allow/deny · rate limit
Ingress
API Gatewayauth · throttling
Load Balancerhealth checks · SSL offload
ArtzAIn · Decision DECISION
Input Screening
decide()screen_user_input()should_block()
First chokepoint. Injection screening before the model is called.
Agent Compute · VPC
Static Prompt Defenseaugment_system_prompt()
Agent OrchestratorECS / Lambda / EKS
LLM Inference
Amazon Bedrockmanaged foundation models
External LLM APIsvia NAT / PrivateLink
ArtzAIn · Decision DECISION
Output Guard + Kill Switch
decide()screen_agent_action()raise_if_killed()
Second chokepoint. Policy-clear the proposed action before it touches a system of record.
Data & Tools · VPC
Relational DBRDS / Aurora
Object StorageAmazon S3
Observability & Audit
CloudWatch + CloudTrailmetrics · logs · API audit
DashboardPrompt-Defense grades · alerts

Developer reference

Everything you need to integrate the engine.

The reference below is the current source of truth, versioned with the package. Changelog and versioning policy ship with the PyPI release notes.

Key capabilities

Prompt DefenderBuild-time + runtime prompt-injection screening (LLM01 in the OWASP Top 10 for LLM Applications), graded A to F, with prebuilt RuleSet.FINANCIAL and RuleSet.LEGAL safeguards for the system prompt. Detections are written to a hash-chained local event log; a decide() call with an API key seals the decision itself.
Client Policy EnforcementActions cleared against configurable enterprise rules before they run: your policy bundle's rules on every decision, or rules derived from your policy documents, screened locally with screen_client_policy().
Destructive-Action GuardScreens proposed SQL, shell, git and cloud actions by severity (low → critical) before execution.
Agent Kill SwitchPanic-threshold auto-stop. A critical match in screen_agent_action() trips that run and raises AgentKilledError. By default, five critical trips within 60 seconds trip a global panic that stops every run, as trip_global() does by hand. A kill-switch event, not a verdict.
Signed Decision RecordsWith an API key, each decide() decision is Ed25519-signed into an append-only, hash-chained ledger before it returns. Exported evidence verifies offline with artzain audit verify.

Delegation of Authority is the governance framing these controls implement: the agent's row on your DOA matrix, enforced via Client Policy Enforcement and Destructive-Action Guard severity thresholds. It is not a separate shipping feature.

Performance

184msmedian, end-to-end

3,000+decisions / hr

7-yrreconstructable trail

LLM01OWASP LLM Top 10

SDK surface

Decisions

decide()

Screening

screen_user_input()
evaluate_system_prompt()
augment_system_prompt()
screen_external_content()

Enforcement

screen_client_policy()
screen_action()
screen_agent_action()
should_block()

Kill switch

trip_global()
raise_if_killed()

Audit

verify_chain()
post_generation_outcome()

AWS deployment · two insertion points

ArtzAIn inserts at two points in an AWS agent stack, without re-architecting it.

# 1 · before the model is called
result = artzain.screen_user_input(user_message, source="chat")
if artzain.should_block(result):
    raise Denied   # Bedrock / external LLM never invoked

# 2 · before any action or data write
artzain.raise_if_killed(run_id)   # a tripped run stops before it acts
call = {"tool": "execute_sql", "arguments": {"sql": sql}}
try:
    d = artzain.decide(
        action="execute_sql",
        target="rds:orders",
        payload=json.dumps(call, ensure_ascii=False),
        kind="tool_call",
    )
except artzain.DecisionError:
    d = {"outcome": "deny"}   # the engine did not decide: fail closed
if d["outcome"] == "allow":
    # a critical match trips this run and raises AgentKilledError
    artzain.screen_agent_action(sql, run_id=run_id, source="execute_sql")
    db.execute(sql)

Links

Website cognexuslabs.ai Operator dashboard app.cognexuslabs.ai PyPI package pypi.org/project/artzain npm package npmjs.com/package/@cognexuslabs/artzain Source github.com/CogNEXUSlabs/cognexus-tools Gating tool calls cognexuslabs.ai/install#tool-calls

Dashboard surfaces

Event Logs · Prompt-Defense grades · kill-switch alerts · the Token-to-Outcome leaderboard (post_generation_outcome()).

CogNEXUS Labs developer reference

Links, installation, capabilities, and SDK surface. Markdown, committed to this repo.

Download reference

From SDK to control plane

Same API. Your policies. Your perimeter.

The SDK is how you start. pip install artzain gives you governed decisions in your loop today: input screening, output guard, kill switch, and a hash-chained, HMAC-signed event log you can verify offline with verify_chain(). No VPC, no procurement cycle. Python first; npm i @cognexuslabs/artzain adds a remote-only TypeScript client for Node ≥ 18.

The control plane is how you go to production. ArtzAIn deploys in your VPC. Policy bundles are co-authored with your compliance team, versioned and signed. The agent registry and specialist crew (security-sentinel, legal-watch, compliance-warden, and the rest) vote inline. Every decision is still the same API the SDK already taught you (allow, deny, review), plus a kill-switch event when trip_global() fires.

The artzain SDK is free to install and run locally. The ArtzAIn control plane is an enterprise deployment. Support: hello@cognexuslabs.ai, or book time with an engineer in a pilot.

Supply chain: PyPI releases publish via a Trusted Publisher (OIDC, no long-lived secrets); npm releases carry a provenance attestation bound to the public repo. The guards derive from Microsoft's MIT-licensed agent-governance-toolkit, with attribution.

Request a pilot