Watchlight Developer Edition

The Developer Edition is the free, open front door to the Watchlight Agent Runtime Governance Control Plane — the real authorization engine, running in-process so you can add a governed ALLOW / DENY decision to an AI agent in minutes, with no database, no network, no infrastructure.

pip install watchlight

watchlight is the open Developer-Edition package (the govern decorator, the framework plugins, and the watchlight dev dashboard); it pulls in the compiled authorization engine automatically. That engine is the same one that powers the Watchlight platform — the full pipeline (delegation-chain validation → intent → policy selection → Cedar evaluation → strict-subset scope attenuation → enforcement decision) — embedded as a compiled wheel with an in-memory policy store. Not a reimplementation, not a generic Cedar binding. When it says Deny, it denies for the same reasons production does.

Zero infrastructure

The engine is a self-contained, prebuilt wheel for Linux, macOS, and Windows (Python 3.9+). No Rust toolchain, no services to run — pip install and you have a working decision point.

What you get for free

• A real authorization decision — load Cedar policies, authorize an action, get back Allow / Deny with the governing reason.
• Fail-closed by design — ambiguity denies. Nothing is permitted unless a policy explicitly allows it.
• In-process scope attenuation — the same strict-subset sub-agent scoping the platform enforces.
• A single prebuilt wheel per platform — install and go.

The Developer Edition license lets you use watchlight-engine free for internal development, testing, and evaluation. Production, commercial, and third-party service use is covered by the Enterprise license.

Where it fits

The Developer Edition is the entry point to the Watchlight progressive deployment model: start locally, in-process, with the real engine; graduate to the governed control plane when you need signed lineage, fleet-wide governance, and the operator console. Nothing is rewritten between stages — the policies you write and the guarantees you rely on are identical.

	Developer Edition	Watchlight Beacon (Enterprise)
Runs	In-process, on your machine	The governed control plane
Backend	Embedded engine, in-memory	Distributed, persistent, signed
Best for	Building & evaluating locally	Governing agents in production

Next steps

• Quickstart — pip install watchlight, govern a tool, and print your first ALLOW / DENY in under five minutes.
• Govern a framework agent — LangGraph, Pydantic AI, or the Claude Agent SDK, in-process.
• Govern an MCP server — a policy enforcement point in front of any MCP server.
• Cedar policy syntax and examples — the policy language the engine evaluates.
• Developer Edition vs Enterprise — what the control plane adds, and when to reach for it.

Watch it live

Run watchlight dev for a local dashboard that streams every ALLOW / DENY decision as your agent runs.