> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rubric-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rubric — runtime governance for AI agents

> Per-agent identities, runtime policy enforcement, and an audit trail for every tool call your agents make.

Rubric gives every agent you ship a cryptographic identity, evaluates every tool call against your policy bundle, and writes a tamper-evident audit log.

You drop the SDK into your agent process. Your operators author policies and watch the audit log in the dashboard. SDKs are available for Python and Node.

<CardGroup cols={2}>
  <Card title="5-minute quickstart" icon="rocket" href="/guides/quickstart">
    Install the SDK, enroll your first agent, and watch a denied call land in the dashboard.
  </Card>

  <Card title="How it works" icon="diagram-project" href="/concepts/architecture">
    What the SDK does in your process and what it sends over the wire.
  </Card>

  <Card title="Write a policy" icon="file-shield" href="/concepts/policies">
    YAML in the dashboard, versioned and dry-runnable. Conditions, effects, scope.
  </Card>

  <Card title="Govern Claude Code" icon="terminal" href="/adapters/claude-code">
    `npm i -g @rubric-app/claude-code` — gate your developer's own Claude Code install through your policies.
  </Card>
</CardGroup>

## What you get

<Steps>
  <Step title="Per-agent signed identity">
    Every agent gets its own short-lived (60-min) signed token, issued on enrollment and auto-refreshed by the SDK. The agent's identity is bound cryptographically — events ship with attribution that can't be spoofed.
  </Step>

  <Step title="Runtime policy enforcement">
    Policies are YAML, versioned, published as bundles, and pulled by the SDK every 30 seconds. Evaluation happens **in-process** — sub-millisecond, no network round-trip per tool call.
  </Step>

  <Step title="Full audit trail with optional traces">
    Every `evaluate()` call writes an audit event. Attach a `TraceContext` and the SDK uploads the full conversation transcript so you can click into any decision and see exactly what the model was thinking.
  </Step>

  <Step title="DLP pre-flight">
    Optional inline DLP scan over tool arguments — regex or Presidio-backed. Detected types become first-class policy fields (`dlp_severity eq high → deny`).
  </Step>
</Steps>

## Three lines of code

```python theme={null}
import rubric

rubric.init(agent_name="payments-bot")  # once, at process startup

@rubric.tool
def delete_file(path: str) -> str:
    ...                              # raises GovernanceDeniedError if denied
```

Set `AG_ENROLLMENT_TOKEN` once, sprinkle `@rubric.tool` over your tool functions, and every call routes through your policy bundle. No `with` blocks, no manual `evaluate()` calls.

## Pick your adapter

If you're using a framework, the adapter wraps your tools so you don't write any glue code yourself:

<CardGroup cols={3}>
  <Card title="MCP" icon="plug" href="/adapters/mcp">
    `govern_mcp_session(gov, session)` — works against any MCP-speaking server.
  </Card>

  <Card title="Claude Agent SDK" icon="anthropic" href="/adapters/claude-agent">
    `governance_hook_matchers(gov)` — installs a `PreToolUse` hook.
  </Card>

  <Card title="LangChain" icon="link" href="/adapters/langchain">
    `govern_tools(gov, tools, session_id)` — wraps any `BaseTool` list.
  </Card>
</CardGroup>

## Govern Claude Code

A different shape: Rubric also ships a CLI that gates your **developer's own** Claude Code install through the same policies. Same policy authoring, same dashboard, same audit log — different host. Useful when the AI agent you're worried about isn't one you wrote.

<Card title="Claude Code adapter" icon="terminal" href="/adapters/claude-code">
  `npm i -g @rubric-app/claude-code && rubric init` — installs a loopback daemon that runs every Claude Code tool call through your bundle. Survives reboots via launchd/systemd.
</Card>