r/learnAIAgents • u/RossPeili • 2h ago
[Project] Non-invasive runtime governance for LLM agents (loop cycle detection, PII pseudonymization, secret brokering)
Hey everyone,
Over the past few months of running autonomous agents in production, we noticed that while agent frameworks (LangGraph, CrewAI, AutoGen, or custom loops) are great at orchestration, they rarely provide runtime governance at the boundary.
Agents still: 1. Fall into 2-state oscillation loops (A <-> B) or 3-step repetitive choreography, burning API tokens while failing silently. 2. Leak raw PII (credit cards, SSNs, emails) from tool outputs directly into model prompts and central traces. 3. Receive raw API keys in their system context, making them vulnerable to prompt-injection exfiltration.
We built AURA Harness as an open-source (MIT) Python runtime coat that sits around any agent loop without requiring you to rewrite your code into a new DSL.
We just released v0.3.6, and here are the key architectural additions:
1. Trajectory Cycle Detection (preset: break)
Blunt global rate limits fail on long-running research agents that legitimately call a tool 20 times. AURA uses a sliding trajectory window ($K=8$) to detect:
- 1-cycle action fixation (A -> A -> A)
- 2-cycle alternating state oscillation (A <-> B)
- 3-cycle choreography patterns (A -> B -> C -> A -> B -> C)
- Reasoning inertia (>85% text similarity across consecutive thoughts)
- FinOps token burn-velocity spikes with structured BREAK: prompt-steering directives.
- Cryptographic SHA-256 entry and recurrence hashes conforming to EU AI Act Art. 14 human oversight requirements.
2. Two-Tier PII Masking with Deterministic Pseudonyms
Instead of raw redaction, AURA replaces detected entities with deterministic session-scoped pseudonym tokens (e.g., EMAIL_PSEUDO_a1b2c3). This preserves entity equivalence across multi-step reasoning while keeping real PII off model providers and traces. Zero dependencies required for Tier 1 (includes Luhn checks for credit cards), with optional pluggable NER providers for Tier 2.
3. Capability Broker
Models declare capability references instead of receiving raw API keys. AURA's SecretBroker injects credentials directly into tool arguments or HTTP headers (inject: [{ref, as: "headers.Authorization"}]) at egress. The model never sees the token, and traces automatically redact it.
Quick Example:
```python from aura.api import agent
Declare governance posture
bot = agent( "devops-bot", spectrum={"level": "full"}, # Auto-wires monitor and break observers )
Run your existing loop inside an AURA coat
with bot.session() as session: session.emit("tool.call", {"tool": "db_query", "args": {"sql": "SELECT 1"}}) # Egress constraints validate schema, scrub secrets, and audit calls ```
On close, it generates a tamper-evident SHA-256 hash-chained JSONL trail and an audit report with pass/fail findings.
- GitHub: https://github.com/ARPAHLS/aura
- Release notes: https://github.com/ARPAHLS/aura/releases/tag/v0.3.6
- PyPI:
pip install aura-harness==0.3.6
Feedback and questions welcome!
