Governance Layer for Financial agents

Financial Governance Control Plane for Autonomous Agents AgentGuard is a production-grade financial governance and safety control plane for fleets of autonomous AI agents. It functions as an authoritative, fail-closed security boundary between autonomous agents and sensitive financial operations, ensuring that agents only execute transactions within explicitly granted policies, budgets, and approval thresholds. Capabilities & Production Readiness In compliance with the production candidate specification, the capabilities are explicitly categorized: Identity & Impersonation Protection: Cryptographic JWT authentication with role-based access control (ADMIN, OPERATOR, AUDITOR, AGENT). Agents cannot impersonate other agents; requests where token.sub != request.agent_id are rejected with 403 Forbidden. Fail-Closed Gatekeeper: Immediate rejection on missing credentials, expired tokens, revoked agent status, halted fleet status, or downstream service timeouts (OPA/Redis). Deterministic OPA Policy Engine: Open Policy Agent (Rego) policy evaluation with strict fail-closed timeout handling. Atomic Multi-Tier Spending Budgets: Atomic budget reservation across transaction, daily, and fleet-wide spending limits using Redis Lua scripts operating exclusively in minor currency units (paise/cents) to eliminate floating-point drift. Human-in-the-Loop Interception: High-value transactions exceeding policy thresholds automatically enter PENDING_APPROVAL. Operators review requests in a dedicated console. Approvals use database row locks (SELECT ... FOR UPDATE), enforce a 15-minute authoritative UTC expiry, and execute a full re-evaluation pipeline (skipping approval threshold check to prevent loops) while preserving request lineage (parent_request_id, decision_attempt).