Examples

Every example runs against the real engine, is self-contained, and needs no server and no signup. Clone watchlight-de or copy a single file. Run one in a terminal and watchlight dev in another to watch the decisions land.

Start here

Example	What it shows
agent.py	The DENY line — one allowed tool, one denied, refused before it runs.
governed_research_agent.py	Five tools, only research and read permitted; email, transfer and delete are blocked.
context_governance.py	The same call allowed or denied by runtime context; missing context fails closed.
governed_subagents.py	Scope attenuation — a child can only ever narrow; widening is refused.

Govern something you already have

Example	Install
governed_langgraph_agent.py	watchlight[langgraph]
governed_pydantic_ai_agent.py	watchlight[pydantic-ai]
governed_claude_agent.py	watchlight[claude-agent]
governed_deepagents.py	watchlight[deepagents] — runs without an API key
governed_mcp_server.py	watchlight-mcp — a denied tools/call never reaches the server

The how is in Govern an agent you already have and Govern an MCP server.

Policy recipes

These are copy-paste patterns for the decisions people reach for the Developer Edition to make. Each one is a policy, the code that governs the tool, and the tests that prove the verdicts — all run through the real engine on every commit.

Recipe	The question it answers
Money-bounded agent	May this agent spend this much, on this, now — or does a human decide?
Destructive actions	Delete, drop, deploy: require a human, and make some things undeletable.
External messaging	May the agent message outside, and only allowlisted destinations?
Data egress	May this classification of data cross this boundary?
Allow, but redact	Say "yes, but…" in the policy — obligations that ride on the Allow.
Kill switch / quarantine	Stop a suspect agent cold, with a boundary that beats every grant.
Per-user attribution	Attribute the decision to the acting end-user, and scope policy to them.
PII before read	Strip PII from a document before the agent ever sees it.
Screen before model	Catch prompt-injection shapes in what a read returns.
Sub-agent confinement	A spawned agent can only ever do less than its parent.
Audit sink	Ship the value-free trail to a store you already run.
Quotas	Allow this many reads per hour, folded from the trail into Cedar context.

→ All of them

Showcases

These are complete pipelines that run in both lanes and exit non-zero if what happened contradicts the verdict.

Showcase	What it proves
denied-before-execute	A stub bank's call counter is 0 after the denied transfer, 1 after a permitted one.
identity	One engine and one policy set: the agent alone, the agent for a person, a sub-agent under it.
human-in-the-loop	A NeedsApproval hold, a separate approver, the action running exactly once. Replay is refused.
policy-tests-ci	A suite, a workflow, and a deliberately widened policy that turns the run red.
audit-forensics	The questions an incident review asks, answered from value-free records alone.
poisoned-rag	A retrieved document hiding an injection and personal data — withheld, then redacted.
red-team	An adversarial corpus, per-family counts, red if any prompt reaches the model unscreened.
web-backend	FastAPI and Express: the authenticated user becomes the principal on the decision record.