OpenGuardrail

OpenGuardrail is an open-source guardrail service from the alibaba GitHub organization for AI agents that operate real systems. Developers define the checks required before an action; the agent performs them and submits results and evidence, and the service records the assessment and returns ALLOW or DENY. It is documented as a development preview with a v1alpha1 API.

What It Is

OpenGuardrail is a standalone service, written in Go, that enforces evidence-based checks at execution time. Each assessment links the policy revision, check results, evidence and decision so that execution tools can verify them before acting and auditors can review them later. Agents and tools reach it through an HTTP API or the guardrailctl CLI, and an embedded management UI is included.

How the Assessment Flow Works

A policy is defined in a GuardrailSpec, published as an immutable revision and activated for a Scene, which groups the policies for a use case. A Run records the operation context and freezes the chosen policy revision and evaluation deadline. The agent reads the requirements, performs checks with its own tools and submits results and structured evidence, optionally as intermediate snapshots before a final submission. Aggregation is PASS (ALLOW), BLOCKED (DENY) or UNKNOWN (DENY). The execution tool then verifies the stored decision, its validity window and the evidence before acting.

Setup and Integrations

The quickstart runs a file-cleanup demo from source that needs Git, Go and Python 3.9+, with no model account or separate database. A persistent service can be started with make build and the serve command, using SQLite or PostgreSQL storage. Reference integrations include a local cleanup demo, a local recovery agent demo, and synthetic Jenkins and Argo Rollouts demos; GitHub Actions and Argo CD sync hooks are listed as planned. Packaging is provided for Linux and macOS on amd64 and arm64, plus optional Docker deployment.

Current Status and Limits

The README labels the project a development preview, and alpha APIs and storage contracts may change. Checks run outside the service, which does not independently verify submitted observations. Applying decisions belongs to the calling system, and Execution Claims, ActionResults, multi-instance operation and replaceable identity providers are not yet supported.