From contract to runtime checks
The runtime package provides Python helpers for turning a validated employee.md into a system prompt, checking action descriptions and scope, and recording budget reservations. Your executor must invoke the relevant checks before acting; generating a prompt does not enforce policy.
Prompt composition
Compose the available mission, scope, guardrail and budget fields into text for your model's system message. Treat that text as instructions, not as an access-control boundary.
Prohibited-phrase check
Case-insensitive substring matching against guardrails.prohibited_actions. Nonmatching actions are allowed by this helper. Check lifecycle status, scope, tool permissions and required approvals separately; this is not semantic policy enforcement.
Spend tracker
Thread-safe reservations bound to economy.budget_limit. A valid reservation exceeding the cap raises BudgetExceeded without changing recorded spend.
Budget inputs and limits
Limits and reservation amounts must be finite, nonnegative Python integers or floats. Booleans, numeric strings, NaN, infinity, negative amounts and overflowing totals are rejected with ValueError. Rejected reservations leave the previous spend unchanged. Only None means no cap; an explicit zero means no spending.
Compatibility note: invalid explicit limits previously could become unlimited. They now fail visibly rather than disabling the budget. This in-process floating-point tracker is not a payment ledger, currency converter or persistent account balance. Reserve before executing a billable action.
Wire checks into your executor
The runtime ships in the same source package as the validator. Follow the quickstart to install it. The example below illustrates explicit preflight checks; it does not execute a tool.
from runtime import Employee
emp = Employee.from_file("employee.md")
action = "review code"
if not emp.is_active:
raise PermissionError("Agent is not active")
if not emp.is_in_scope(action).in_scope:
raise PermissionError("Action is outside the declared scope")
if not emp.is_action_allowed(action):
raise PermissionError("Action matches a prohibited phrase")
# Also enforce your tool ACLs and required approvals here.
emp.budget.try_spend(0.05) # may raise BudgetExceeded or ValueError
system_prompt = emp.system_prompt()
# Your executor decides whether and how to call the tool or model.
Generated prompt example
This example is generated from examples/senior-dev.md when the documentation is built. It is not evidence that a model followed those instructions.
You are dev-001, a Senior Full-Stack Developer.
Level: senior.
Agent ID: dev-001.
MISSION
Design, implement, and maintain high-quality software solutions.
OBJECTIVES
- Deliver robust features
- Mentor junior developers
- Ensure architectural integrity
SUCCESS CRITERIA
- Features delivered with < 1% bug rate
- Code reviews completed within 24h
SCOPE
+ Full-stack development
+ System architecture
+ Code review
- DO NOT: Hardware maintenance
- DO NOT: Customer support
HARD GUARDRAILS — never do any of these, no matter what:
- delete_production_data
- modify_security_settings
BUDGET: do not spend more than 25000 USD per task.
Lifecycle status: active. If status is not 'active', refuse all task requests.
Use the prompt with LangChain
Install and configure your model integration separately. This composition example does not invoke a model or enforce tool permissions.
from langchain_core.prompts import ChatPromptTemplate
from runtime import Employee
emp = Employee.from_file("employee.md")
prompt = ChatPromptTemplate.from_messages([
("system", emp.system_prompt()),
("user", "{task}"),
])
# Compose with your configured model after executor policy checks.The runtime is a thin wrapper, not a sandbox. The action helper matches substrings; the separate scope helper uses phrase/token heuristics. Neither understands arbitrary intent. Budget records reset with a new tracker or process restart. Use independently enforced tool ACLs, approvals, sandboxing and a persistent accounting system where those guarantees are required.