Guides, SDK references, and operational docs for strahl, the centralized security policy layer for AI agents. It decides what may influence each tool call, before it runs.
Typed clients for the strahl API — labels, tool flow policies, and analysis.
Run and operate strahl-secured agents — configuration, gating, tool registration, and audit logging.
# install
pip install strahl
# label each message role
strahl.set_role_labels({
"user": Label(source={"user"}, visibility={"user"}),
"assistant": Label(source={"assistant"}, visibility={"user"}),
})
# declare the flow policy
@strahl.tool(requires=Label(source={"user"}))
def send_email(to, subject, body): ...
# analyze before the tool executes
analysis = strahl.analyze(messages)
analysis.raise_if_denied()One package, no model to retrain and no rebuild of the stack you already run.
Tell strahl where each message came from and who may see it.
Declare the flow policy a tool call requires before it is allowed to run.
Check the session against the policy and raise before the side effect happens.
See more in the SDK reference ↗
Tell us what you're building and we'll help you get the policy right — early access to the agent harness included.