Audit trail and governance hooks for agent actions

[jagmarques]

ADK provides a solid agent framework but lacks hooks for creating tamper-evident records of agent actions. For regulated deployments, EU AI Act Article 12 requires automatic event logging that can be independently verified.

A callback or middleware interface at the tool execution level would let governance tools sign each action without modifying ADK internals. This pattern exists in LangChain (callback handlers), PydanticAI (pre/post tool hooks), and CrewAI (step callbacks).

Specific needs:

• Pre-tool execution hook with tool name, arguments, and agent context
• Post-tool execution hook with the result
• Session-level lifecycle hooks (start, end, error)

I have implementations for other frameworks and could contribute a PR for the hook interface if there is interest.

[aeoess]

The hook interface you're describing is exactly what we've been running against ADK.

The APS governance hook adapter (src/adapters/governance-hook.ts) wraps any tool call with pre-execution authorization and post-execution receipt signing:

from agent_passport_system import GovernanceHook

hook = GovernanceHook(agent_id=did, delegation_id=del_id, private_key=key)

# Pre-tool: check delegation scope + spend budget
result = hook.evaluate(action_type="tool:search", scope="data:read", cost=0.01)
# result.decision: "permit" | "deny"
# result.receipt: Ed25519-signed, hash-linked to delegation chain

# Post-tool: record outcome
hook.record_outcome(action_ref=result.action_ref, success=True)

Each receipt is Ed25519-signed, includes action_ref (content hash of tool invocation), links to the delegation chain, and is independently verifiable. The receipt chain is tamper-evident — each receipt references the previous receipt hash.

On EU AI Act Article 12: the governance evidence export (createGovernanceEvidenceExport()) produces a signed 9-section artifact covering policy evaluations, revocation events, posture changes, key rotations, and receipt window seals. Single JWS-signed bundle for audit consumption.

The adapter already works with ADK's BasePlugin interface. The pre-tool hook maps to your before_run, post-tool maps to after_run. Session lifecycle hooks (start/end/error) map to our posture events.

This converges with the audit receipt work on #5164 and the bilateral trust scoring on #5166 — different teams arriving at the same hook interface from different directions. A standardized GovernanceProvider protocol for ADK (similar to what CrewAI is discussing in crewAIInc/crewAI#4877) would let multiple governance implementations plug in without competing for the same extension point.

TypeScript: npm install agent-passport-system (v1.36.4, 2,502 tests). Python: pip install agent-passport-system (v0.9.0).

[klateefa]

@jagmarques Thanks for the update. The request is currently being reviewed, and I will let you know if anything further is needed. Thank you for your understanding.