Skip to main content
We started TealTiger with a simple premise: AI agents need deterministic governance. No LLM in the governance path. Same input + same policy = same decision, every time. v1.1 delivered that with TealEngine — a policy evaluation engine that could allow, deny, redact, or degrade agent actions based on configurable rules. v1.2 added parallel module dispatch, TEEC evidence contracts, and governance across six dimensions. v1.3 transforms TealTiger from a policy engine into a complete AI agent governance platform.

​
The Problem We’re Solving

As AI agents move from demos to production, the governance challenge has evolved. It’s no longer enough to evaluate individual requests against policy rules. Production AI agents need:
  • Identity — Who is this agent? Is it authorized? Has it been compromised?
  • Temporal boundaries — How long can it operate? How fast can it act?
  • Behavioral monitoring — Is it acting normally, or has something changed?
  • Cryptographic evidence — Can you prove governance was active at 2:47 PM on June 1st?
  • Platform integration — Governance must work where agents run (Bedrock, AgentCore, Azure)
  • Immutable safety — Controls that cannot be disabled, even by insiders
v1.3 addresses all of these.

​
What’s New

​
Non-Human Identity Governance

AI agents are now first-class principals in TealTiger. Every agent has a registered identity with lifecycle states (active/suspended/revoked), scoped capabilities, environment constraints, and cryptographic attestation. Zero Standing Privilege means no agent holds permanent elevated permissions. Instead, agents request Just-In-Time grants that expire automatically. This limits the blast radius of a compromised agent to the duration of a single grant window.

​
FREEZE Rules — The Last Line of Defense

FREEZE rules are governance’s circuit breaker. They cannot be modified, disabled, or bypassed — regardless of policy changes, hot-swaps, or administrative actions. Any modification attempt triggers FREEZE_TAMPER_ATTEMPT through a hardcoded evidence channel that cannot be reconfigured. Think of them as the governance equivalent of a hardware kill switch.

​
Cryptographic Governance Receipts (TealProof)

TealProof combines Merkle tree inclusion proofs with RFC 3161 timestamping to produce evidence that satisfies legal non-repudiation requirements. The Governance Passport provides rolling attestation of continuous governance coverage — proof that your agents were governed every minute of every day.

​
Behavioral Drift Detection (TealDrift)

TealDrift builds statistical baselines of normal agent behavior and detects deviations in real-time. If an agent’s tool usage pattern, action frequency, or content characteristics shift beyond normal variation, TealDrift flags it — even if no individual action violates a policy rule. This catches the subtle attacks that rule-based systems miss: gradual privilege escalation, indirect prompt injection that alters behavior within policy bounds, and model regressions that change agent behavior unexpectedly.

​
Platform Adapters

TealTiger now integrates natively with:
  • AWS Bedrock Agents — Guardrail adapter for action group governance
  • AWS AgentCore — Lifecycle hooks from creation to termination
  • Azure AI Agent Service — Tool-call pipeline middleware
Deploy governance where your agents run, without modifying agent logic.

​
OWASP Agentic Top 10 Policy Pack

One line of code. All 10 OWASP ASI risks covered. Production-ready defaults. Cross-mapped to NIST AI RMF, ISO 42001, and EU AI Act.
That’s it. Comprehensive AI agent governance deployed in seconds.

​
The Full v1.3 Bundle

  • TealEngine v1.3 — Pre/post evaluation pipeline, FREEZE rules, automation levels, PLAN_ONLY mode
  • NHI Governance — Identity lifecycle, scope enforcement, JIT grants, attestation
  • TealProof — Merkle trees, RFC 3161 timestamps, Governance Passport, Verification SDK
  • TealFlow — Declarative YAML workflows, org inheritance, floor enforcement
  • TealClassifier — Local ONNX inference, 4 ensemble modes
  • TealDrift — Statistical baselines, MCP definition-drift monitoring
  • TealState — Context size governance, provenance metadata
  • TealTemporal — Session TTL, cooldowns, time-of-day restrictions
  • TealMonitor v2 — Cost limits, anomaly detection, reasoning-token budgets
  • Platform Adapters — Bedrock, AgentCore, Azure AI Agent Service
  • SOC/IR Pipeline — JSON/CEF/LEEF export, OTel spans, response hooks
  • OWASP Policy Pack — Zero-config ASI-01 through ASI-10
  • Anti-Tamper Controls — Forbidden keys, bundle integrity, workload binding
  • Code Change Governance — Path/branch allowlists, diff hashes, two-person rule

​
Backward Compatibility

v1.3 is fully backward-compatible with v1.2. Your existing code works without changes. The TealEngineV12 class and evaluateV12() method are preserved. Adopt new features at your own pace.

​
Getting Started

Start with the Migration Guide for the upgrade path, or jump straight to the OWASP Policy Pack for instant comprehensive coverage.

​
What’s Next

v1.3 establishes the platform foundation. Upcoming work focuses on:
  • Multi-agent governance — Cross-agent policy coordination
  • Governance-as-Code pipelines — GitOps for governance policy
  • TealTiger Cloud — Managed governance service
  • Python SDK parity — All v1.3 modules in Python