WarrantSee which real decisions your change flips. Before you ship it.
Warrant records every consequential action your AI agents take: what allowed it, what it relied on, what it cost and how it turned out. Then it replays those real decisions against your next prompt, model or policy.
pip install "warrantai[policy]"Open source, Apache 2.0 · Python 3.10+, and Node.js 18+ · runs entirely on your machine · quick start on PyPI
approve when bureau score ≥ 720, on the larger modelapprove when bureau score ≥ 750, on a cheaper model
- Decisions that flip
- 0 of 200
- Flipped loans that later defaulted
- 0
- Cost per decision
- ₹3.15
| Loan | Decision | What happened to the loan |
|---|---|---|
LN-40000 | refer | not known yet |
LN-40002 | approve | not known yet |
LN-40003 | refer | performing |
LN-40032 | approve | default |
LN-40039 | approve | default |
LN-40042 | approve | not known yet |
LN-40047 | approve | default |
LN-40121 | approve | performing |
The problem
Your agents now act. The log cannot say why.
When a person approves a loan, the file shows who, under which rule, looking at which documents. When an agent does it, you get a trace only an engineer can read.
- Was it allowed?
- Which policy, which version and which clause permitted it, or did not.
- What did it rely on?
- The documents, tool results and model calls, each held by reference and hash.
- What did it cost?
- Not the monthly AI bill. This one decision.
- Was it right?
- Did the loan perform, did the invoice hold up. Outcomes attach to the decision later.
- What changes if we change it?
- Which real past decisions would flip under tomorrow's prompt, model or policy.
Start with what you already have
Three of these six past decisions were outside the agent's mandate.
You do not need to instrument anything to get a first answer. warrant import rebuilds decision records from OpenTelemetry trace exports and checks each one against your written policy, after the fact.
This is the example trace export in the Warrant repository. Imported records are labelled origin: imported: they are findings, and are never presented as evidence sealed at the time of the decision.
$ warrant import traces.jsonl --taxonomy taxonomy.yaml --policy policies --dry-run
read 24 span(s) in 6 trace(s) from 1 file(s)
would write 6 record(s) (dry run) to stream 'lending-import' with origin: imported
credit.approve: 6 decision(s), 6 with inputs, 6 with model calls checked against COL-02@2026.1, CR-07@2026.3
allow 3 deny 1 escalate 2 unchecked 0
3 decision(s) outside mandate:
LN-30002 escalate CR-07 clause 4.3 Refer tickets above 5,00,000 to a credit officer
LN-30003 deny CR-07 clause 4.1 Decline below bureau floor
LN-30004 escalate CR-07 default no clause matchedHow it works
Check. Record. Seal. Replay. Review.
Warrant sits beside your agent, not in front of it. It is a library and a store, not a proxy: your model calls never pass through it.
Check
Before acting, the agent asks whether the action is inside its written policy. The check runs in-process: no network call, 0.26 ms at p99 in our Python benchmark. The same policy files evaluate the same way in JavaScript.
Platform teamsRecord
The decision, its evidence, its cost and the policy result are queued and written by a background thread. If the store is down, records spill to disk and your agent keeps working.
DevelopersSeal
The store chains every record to the one before it with SHA-256 and refuses updates and deletes. Any later edit breaks the chain.
AuditorsReplay
Before shipping, re-run saved sets of real decisions against your change with recorded tool results frozen. See what flips, what is newly denied and what it does to cost.
DevelopersReview
Escalations, out-of-mandate actions and a random sample go to human reviewers. Verdicts and outcomes are appended as new sealed records.
Risk and finance
Do not take our word for the seal
This chain is being verified in your browser. Try to break it.
Five records written by the SDK, exactly as the store sealed them. Your browser recomputes every hash with the same rule as the free warrant verify command: SHA-256 over the record, a newline, and the hash before it.
Change any record and watch where the chain fails. Then try to cover your tracks, and see what an auditor holding last month's export would notice.
- lending #1LN-0411 · approve · allowed by CR-07 §4.2checking
prev start of chainhash 33a6364c…d61f - lending #2LN-0417 · approve · allowed by CR-07 §4.2checking
prev 33a6364c…d61fhash 07c3c8b2…11fe - lending #3LN-0423 · held back · sent to a human by CR-07 §4.3checking
prev 07c3c8b2…11fehash 1b6ed143…bc3b - lending #4LN-0431 · held back · denied by CR-07 §4.1checking
prev 1b6ed143…bc3bhash 1d81e349…d46d - lending #5Outcome recorded later: performingchecking
prev 1d81e349…d46dhash 274d2c24…20dc
Checking the chain in your browser…
For developers
A regression suite made of decisions that really happened.
- Decision sets. Save the hard cases, the defaults and the near-misses from production, with outcomes joined, and test against them every time.
- Honest replay. Recorded tool results are served back in order. A tool the recording never saw is reported as unreplayable, never quietly run live.
- A failing build, with names. Which decisions flipped, which the policy newly denies, what it does to cost, as JUnit for your pipeline.
# wrap the decision, not the model
with w.decide("credit.approve", subject=loan.id) as d:
verdict = d.check(amount=loan.amount, bureau_score=score, foir=foir)
d.evidence("bureau_pull", uri=bureau.uri, content=bureau.raw)
if verdict.allowed:
d.act("approve", summary=result.summary)
w.outcome(subject=loan.id, label="performing") # months later$ warrant test lending-all --against underwriter-v2.4 --fail-on flipped
# 200 decisions replayed (frozen) against underwriter-v2.4
# 17 flipped (17 approve -> refer)
# by recorded outcome: 13 default, 2 (no outcome), 2 performing
# cost 3.15 -> 0.74 per decision (-77%)
# FAILED: 17 flipped decision(s) exceed threshold 0For risk, finance and audit
Review agent decisions the way you review people's.
The same records read in plain language, queue up for human review and add up to a cost per decision. If you run lending, collections or KYC agents, there is a page for you.
credit-underwriter (version 2.3.1) carried out “approve” for LN-0411, on 17 Sep 2026.
Policy CR-07 (version 2026.3) allowed this under clause 4.2: auto-approve up to 5,00,000 when bureau score is at least 720 and FOIR at most 45%.
It cost INR 3.84. Outcome “performing”, from lms://demo.
Where it stands
What you can install today, and what is still coming.
Shipped, as of 0.3.0
- Python SDK: decide(), check(), evidence, cost, outcomes, human verdicts
- Policy bundles in CEL with fail modes and embedded tests
- Append-only store with a SHA-256 chain, export and offline verifier
- Replay: decision sets, targets, warrant test with JUnit output for CI
- OpenTelemetry capture of model and tool calls inside a decision
- warrant import: decision records from the traces you already have
- Collector and PostgreSQL store for shared, self-hosted deployments
- JavaScript and TypeScript SDK: decide(), evidence, cost, outcomes, redaction
- Policy bundles that evaluate identically in Python and JavaScript, with a shared conformance suite
- Adapters for the Claude Agent SDK, LangGraph and Temporal: name the tool calls or activities that are decisions, no other code change
- MCP server: mandate checks and decision records for agents in any MCP-capable host
- GitHub Action: replay recorded decisions against a change in CI and fail on flips
In progress
- Console: explorer, review queues, cost views (in early access)
- Adapters for the OpenAI Agents SDK and CrewAI
- Signed checkpoints and per-writer signing
- Audit packs, SSO and an auditor role, hosted India region
Pricing
Developers start free. Risk teams pay for proof.
Open source
Free
The SDK, policy checks, the sealed local store, replay, import and the verifier. Apache 2.0, on your own machines, for as long as you like.
Install from PyPITeam
₹1,500 per seat a month · $19
Planned for teams: shared decision sets and workspaces, hosted records and a version registry for prompts and policies. Early-access pricing, opening to design partners first.
Ask for early accessBusiness and Enterprise
Talk to us
The review console, cost reporting, long retention, and deployment in your own cloud or an India region. Every engagement starts with the two-week test.
Book the two-week testThe two-week test
One real workflow. Fourteen days. A finding on day one.
We start with what your agents have already done, not with a new integration. The fee is credited in full against your first year.
- Day 1Import the traces you already have, check every past decision against your written policy, and hand you the first finding.
- Days 2 to 5Instrument one live agent workflow inside your environment. Nothing leaves your systems.
- Days 6 to 12Record real decisions. Your risk team runs one review cycle on escalations, flagged decisions and a random sample.
- Days 13 and 14A written finding, a replay walkthrough for your engineers, and an export your auditor can verify offline.
Book the test
Leave a work email. One reply, from a person, within two working days.
Questions worth asking
Does Warrant slow my agent down?
Recording is asynchronous and added 0.16 ms at p99 in our benchmark; the in-process policy check took 0.26 ms at p99 (3,000 decisions, a three-clause policy, an Apple M5 laptop). Warrant is never in the path of your model calls. If the store is unavailable, records spill to disk and are sent later.
What data does Warrant store?
The decision, the policy result, cost and later outcomes. Evidence is stored as a reference and a content hash pointing back to your systems; capturing inputs and tool results is opt-in, meant for development and staging so replay has something to run on. Free-text fields can be redacted before anything leaves the process.
What stops someone editing a record?
The store refuses updates and deletes, and every record's hash covers the record before it, so a changed record no longer matches its seal. Someone with full database access could rebuild the whole chain, which is why an export, or just its last hash, held outside the store settles the question. Signed checkpoints that close this gap without a second copy are on the roadmap, not shipped.
Which frameworks and models does it support?
Any agent you can call from Python or Node.js. You wrap the decision, not the model. In Python, model and tool calls made through OpenTelemetry-instrumented libraries are picked up as evidence automatically. The JavaScript SDK records to a collector; the local store, replay and import are in the Python package. Adapters for the Claude Agent SDK, LangGraph and Temporal name the tool calls or activities that are decisions and gate and record them without other changes; agents in an MCP-capable host use the MCP server.
Is this a compliance product or a developer tool?
Both, on purpose. Developers use replay the way they use a test suite; risk and audit teams use the same records to review and to prove. One set of records, two views.
How does it run in CI?
warrant test exits non-zero when decisions flip, a policy newly denies, or cost rises past your limit, and writes a JUnit report listing the exact decisions affected. A packaged GitHub Action is on the way; today it is one command in any pipeline.