\r \r

AgentMesh Governance — Trust & Policy for OpenClaw Agents\r

\r Zero-trust governance layer for OpenClaw agents. Enforce policies, verify identities,\r score trust, and maintain tamper-evident audit logs — all from your agent's command line.\r \r

Setup\r

\r Install the AgentMesh governance CLI:\r \r

pip install agentmesh-governance\r
```\r
\r
> If `agentmesh-governance` is not yet on PyPI, install directly from source:\r
> ```bash\r
> pip install "agentmesh @ git+https://github.com/imran-siddique/agent-mesh.git"\r
> ```\r
\r
## Scripts\r
\r
All scripts are in `scripts/`. They wrap the governance engine and output JSON results.\r
\r
### Check Policy Compliance\r
\r
Evaluate an action against a governance policy before execution:\r
\r
```bash\r
scripts/check-policy.sh --action "web_search" --tokens 1500 --policy policy.yaml\r
```\r
\r
Returns JSON with `allowed: true/false`, any violations, and recommendations.\r
Use this **before** executing any tool call to enforce limits.\r
\r
### Get Trust Score\r
\r
Check an agent's current trust score (0.0 – 1.0):\r
\r
```bash\r
scripts/trust-score.sh --agent "research-agent"\r
```\r
\r
Returns the composite trust score with breakdown across 5 dimensions:\r
policy compliance, resource efficiency, output quality, security posture,\r
collaboration health.\r
\r
### Verify Agent Identity\r
\r
Verify an agent's Ed25519 cryptographic identity before trusting its output:\r
\r
```bash\r
scripts/verify-identity.sh --did "did:agentmesh:abc123" --message "hello" --signature "base64sig"\r
```\r
\r
Returns `verified: true/false`. Use when receiving data from another agent.\r
\r
### Record Interaction\r
\r
Update trust scores after collaborating with another agent:\r
\r
```bash\r
scripts/record-interaction.sh --agent "writer-agent" --outcome success\r
scripts/record-interaction.sh --agent "writer-agent" --outcome failure --severity 0.1\r
```\r
\r
Success adds +0.01 to trust score. Failure subtracts the severity value.\r
Agents dropping below the minimum threshold (default 0.5) are auto-blocked.\r
\r
### Audit Log\r
\r
View tamper-evident audit trail with Merkle chain verification:\r
\r
```bash\r
scripts/audit-log.sh --last 20\r
scripts/audit-log.sh --agent "research-agent" --verify\r
```\r
\r
The `--verify` flag checks Merkle chain integrity — any tampering is detected.\r
\r
### Generate Identity\r
\r
Create a new Ed25519 cryptographic identity (DID) for your agent:\r
\r
```bash\r
scripts/generate-identity.sh --name "my-agent" --capabilities "search,summarize,write"\r
```\r
\r
Returns your agent's DID, public key, and capability manifest.\r
\r
## Policy File Format\r
\r
Create a `policy.yaml` to define governance rules:\r
\r
```yaml\r
name: production-policy\r
max_tokens: 4096\r
max_tool_calls: 10\r
allowed_tools:\r
  - web_search\r
  - file_read\r
  - summarize\r
blocked_tools:\r
  - shell_exec\r
  - file_delete\r
blocked_patterns:\r
  - "rm -rf"\r
  - "DROP TABLE"\r
  - "BEGIN CERTIFICATE"\r
confidence_threshold: 0.7\r
require_human_approval: false\r
```\r
\r
## When to Use This Skill\r
\r
- **Before tool execution**: Run `check-policy.sh` to enforce limits\r
- **Before trusting another agent's output**: Run `verify-identity.sh`\r
- **After collaboration**: Run `record-interaction.sh` to update trust\r
- **Before delegation**: Check `trust-score.sh` — don't delegate to agents below 0.5\r
- **For compliance**: Run `audit-log.sh --verify` to prove execution integrity\r
- **On setup**: Run `generate-identity.sh` to create your agent's DID\r
\r
## What It Enforces\r
\r
| Policy | Description |\r
|--------|-------------|\r
| Token limits | Cap per-action and per-session token usage |\r
| Tool allowlists | Only explicitly permitted tools can execute |\r
| Tool blocklists | Dangerous tools are blocked regardless |\r
| Content patterns | Block regex patterns (secrets, destructive commands, PII) |\r
| Trust thresholds | Minimum trust score required for delegation |\r
| Human approval | Gate critical actions behind human confirmation |\r
\r
## Architecture\r
\r
This skill bridges the OpenClaw agent runtime with the [AgentMesh](https://github.com/imran-siddique/agent-mesh)\r
governance engine:\r
\r
```\r
OpenClaw Agent → SKILL.md scripts → AgentMesh Engine\r
                                     ├── GovernancePolicy (enforcement)\r
                                     ├── TrustEngine (5-dimension scoring)\r
                                     ├── AgentIdentity (Ed25519 DIDs)\r
                                     └── MerkleAuditChain (tamper-evident logs)\r
```\r
\r
Part of the [Agent Ecosystem](https://imran-siddique.github.io):\r
[AgentMesh](https://github.com/imran-siddique/agent-mesh) ·\r
[Agent OS](https://github.com/imran-siddique/agent-os) ·\r
[Agent SRE](https://github.com/imran-siddique/agent-sre)\r