# Show HN: RBEK – governed execution for AI agent

> Source: <https://github.com/rbekplatform/rbek>
> Published: 2026-08-13 12:24:38+00:00

**Governed execution for AI agents, workflows and software.**

RBEK separates what an agent **wants to do** from what it is **authorized to execute**.

```
curl -fsSL https://raw.githubusercontent.com/rbekplatform/rbek/main/examples/real-governed-agent/demo.sh | bash
```

**No API key. No prior RBEK installation. No configuration.**

The demo installs and validates the public RBEK CLI when needed, then runs an offline governed proof:

``` php
Agent requests an action
        |
        +-- unauthorized -> DENY  -> executed: NO
        |
        +-- authorized   -> ALLOW -> governed dry-run -> AUTHORIZED
                                                |
                                                +-- evidence
```

What you see in the terminal:

```
Unauthorized action ............ DENIED
Denied action executed ......... NO
Authorized action .............. ALLOWED
Governed dry-run ............... PASS
Gate authorization ............. AUTHORIZED
RBEK policy enforcement ........ REAL
RBEK evidence .................. REAL
```

The default proof performs **no external network action**. Policy enforcement
and evidence generation are real RBEK behavior.

The public GitHub Actions workflow executes the proof twice and verifies that the deterministic evidence summary is identical across both runs.

Use **Open in GitHub Codespaces** above, then run:

```
cd examples/real-governed-agent
./demo.sh
cd examples/real-governed-agent
export OPENAI_API_KEY="your-key"
./demo.sh --live
```

Live mode performs real model inference and a real Open-Meteo external action through the RBEK governed execution boundary.

AI agents can decide what they want to do. Production systems still need a controlled boundary for what is actually allowed to execute.

RBEK puts that boundary between application logic and real external actions:

```
agent / workflow
      ↓
execution request
      ↓
RBEK policy admission
   ↙             ↘
 DENY            ALLOW
                   ↓
               execute
                   ↓
               evidence
```

This keeps execution governance separate from the agent framework, model provider or workflow engine.

```
curl -fsSL https://releases.rbekplatform.com/cli/stable/install.sh | bash
```

Verify:

```
rbek-cli --version
```

Current public stable:

```
RBEK 0.2.0
```

Create and run a minimal local RBEK project:

```
rbek-cli init ./rbek-demo
rbek-cli run ./rbek-demo
```

Or run the repository example:

```
bash examples/5-minute-quickstart/run.sh
```

The goal of the first five minutes is simple: install RBEK, create a governed local project and execute it through the RBEK CLI.

See [QUICKSTART.md](/rbekplatform/rbek/blob/main/QUICKSTART.md) for the complete first-run walkthrough.

After the zero-key proof, you can run the real agent path:

```
cd examples/real-governed-agent
export OPENAI_API_KEY="your-key"
./demo.sh --live
```

In live mode:

```
OpenAI agent
     ↓
weather.current
     ↓
RBEK policy admission
     ↓
controlled external execution
     ↓
Open-Meteo
     ↓
receipt + certification
```

The agent does not call Open-Meteo directly. The external action goes through the RBEK governed execution boundary.

See
[examples/real-governed-agent/README.md](/rbekplatform/rbek/blob/main/examples/real-governed-agent/README.md)
for details.

Developer is the public CLI entry point for local development, evaluation and integration.

It does not require a paid commercial entitlement.

Team and Enterprise commercial access are handled separately.

This repository contains Developer documentation, examples and installation guidance.

The RBEK runtime is distributed through the official release host:

`https://releases.rbekplatform.com`

The complete runtime source is not published in this repository.

`https://rbekplatform.com`

See [SECURITY.md](/rbekplatform/rbek/blob/main/SECURITY.md).