Execution Governance

Pavri execution governance controls where agent code runs and what outbound network calls it can make. Operators configure execution profiles to sandbox high-risk agents, and egress rules to restrict or audit outbound traffic.

Execution Profiles

An ExecutionProfile defines the routing mode for an agent's code execution:

Routing Mode	Description
in_process	Agent runs in the same Python process (default). No isolation.
os_jail	Agent runs in a sandboxed environment using OS-level isolation (seccomp/chroot).
container	Agent runs in an isolated OCI container.

Fail-Closed Semantics

If an execution profile requires os_jail or container but the capability is not available in the current runtime, Pavri denies the execution rather than falling back to in_process. This prevents policy bypass through environment degradation.

To allow degraded fallback (not recommended for production), set fail_open=True when constructing the ExecutionRouter.

Configuring a Profile

from pavri.core.governance import ExecutionProfile, RoutingMode

profile = ExecutionProfile(
    profile_id="prof-pci-agents",
    org_id="org-1",
    name="pci-scope",
    routing_mode=RoutingMode.container,
    enabled=True,
    network_access=False,
    allowed_syscalls=[],
    blocked_paths=["/etc", "/proc"],
)

Attach the profile to the SDK runtime before securing an agent:

import pavri

runtime = pavri.secure(my_agent, config=config)
runtime.execution_profile = profile

Detecting Unsafe Settings

from pavri.core.execution_router import ExecutionRouter

router = ExecutionRouter()
warnings = router.detect_unsafe_settings(profile)
for w in warnings:
    print("WARNING:", w)

Common warnings:

• network_access=True with in_process routing provides no network isolation
• No filesystem path restrictions configured for in_process routing
• No syscall filtering configured for os_jail or container routing

Egress Rules

Egress rules evaluate outbound network calls made by agents. Rules support:

• Allow lists — only permit specified domains and protocols
• Block lists — deny specific domains or protocols regardless of other rules
• Default actions — allow, deny, or log for traffic that doesn't match any explicit rule
• Wildcard patterns — match subdomains using * (e.g., *.internal.example.com)

Priority Order

1. Blocked domains/protocols — highest priority, deny immediately
2. Allow lists (if configured) — if a domain is not in the allow list, deny
3. Default action — reached only when no allow lists are configured

Example

from pavri.core.governance import EgressRule, EgressAction

rule = EgressRule(
    rule_id="egr-strict",
    org_id="org-1",
    name="internal-only",
    allowed_domains=["*.internal.example.com", "api.stripe.com"],
    blocked_domains=["data-exfil.attacker.com"],
    default_action=EgressAction.deny,
    enabled=True,
)

Evaluating Egress

from pavri.core.egress_controller import EgressController

controller = EgressController()
decision = controller.evaluate(
    rule=rule,
    domain="payments.internal.example.com",
    protocol="https",
    agent_id="agt-1",
    session_id="sess-1",
)

if decision.outcome == "denied":
    raise PermissionError(f"Egress blocked: {decision.reason}")

Viewing Routing Decisions in the Dashboard

Navigate to Governance > Execution to see a log of routing decisions. Each decision shows:

• The routing mode applied (in_process, os_jail, container)
• The outcome (allowed, simulated, denied)
• The reason for the decision
• Any associated egress rule evaluation result

Routing decisions are recorded for every agent invocation and are available for audit.

API

GET  /api/v1/governance/execution              # List routing decisions
POST /api/v1/governance/execution/record        # Record a new decision (SDK-facing)
GET  /api/v1/governance/execution?agentId=X    # Filter by agent
GET  /api/v1/governance/execution?sessionId=X  # Filter by session