Show HN: RBEK – governed execution for AI agent

RBEK 0.2.0, a governed execution platform for AI agents, has been released as an open-source developer CLI that separates agent intent from authorized execution, enforcing policy admission before external actions and generating deterministic evidence. The platform, distributed via releases.rbekplatform.com, includes a zero-key offline demo and a live mode integrating with OpenAI agents and Open-Meteo, with commercial Team and Enterprise access handled separately.

Governed execution for AI agents, workflows and software. RBEK separates what an agent wants to do from what it is authorized to execute . curl -fsSL https://raw.githubusercontent.com/rbekplatform/rbek/main/examples/real-governed-agent/demo.sh | bash No API key. No prior RBEK installation. No configuration. The demo installs and validates the public RBEK CLI when needed, then runs an offline governed proof: php Agent requests an action | +-- unauthorized - DENY - executed: NO | +-- authorized - ALLOW - governed dry-run - AUTHORIZED | +-- evidence What you see in the terminal: Unauthorized action ............ DENIED Denied action executed ......... NO Authorized action .............. ALLOWED Governed dry-run ............... PASS Gate authorization ............. AUTHORIZED RBEK policy enforcement ........ REAL RBEK evidence .................. REAL The default proof performs no external network action . Policy enforcement and evidence generation are real RBEK behavior. The public GitHub Actions workflow executes the proof twice and verifies that the deterministic evidence summary is identical across both runs. Use Open in GitHub Codespaces above, then run: cd examples/real-governed-agent ./demo.sh cd examples/real-governed-agent export OPENAI API KEY="your-key" ./demo.sh --live Live mode performs real model inference and a real Open-Meteo external action through the RBEK governed execution boundary. AI agents can decide what they want to do. Production systems still need a controlled boundary for what is actually allowed to execute. RBEK puts that boundary between application logic and real external actions: agent / workflow ↓ execution request ↓ RBEK policy admission ↙ ↘ DENY ALLOW ↓ execute ↓ evidence This keeps execution governance separate from the agent framework, model provider or workflow engine. curl -fsSL https://releases.rbekplatform.com/cli/stable/install.sh | bash Verify: rbek-cli --version Current public stable: RBEK 0.2.0 Create and run a minimal local RBEK project: rbek-cli init ./rbek-demo rbek-cli run ./rbek-demo Or run the repository example: bash examples/5-minute-quickstart/run.sh The goal of the first five minutes is simple: install RBEK, create a governed local project and execute it through the RBEK CLI. See QUICKSTART.md /rbekplatform/rbek/blob/main/QUICKSTART.md for the complete first-run walkthrough. After the zero-key proof, you can run the real agent path: cd examples/real-governed-agent export OPENAI API KEY="your-key" ./demo.sh --live In live mode: OpenAI agent ↓ weather.current ↓ RBEK policy admission ↓ controlled external execution ↓ Open-Meteo ↓ receipt + certification The agent does not call Open-Meteo directly. The external action goes through the RBEK governed execution boundary. See examples/real-governed-agent/README.md /rbekplatform/rbek/blob/main/examples/real-governed-agent/README.md for details. Developer is the public CLI entry point for local development, evaluation and integration. It does not require a paid commercial entitlement. Team and Enterprise commercial access are handled separately. This repository contains Developer documentation, examples and installation guidance. The RBEK runtime is distributed through the official release host: https://releases.rbekplatform.com The complete runtime source is not published in this repository. https://rbekplatform.com See SECURITY.md /rbekplatform/rbek/blob/main/SECURITY.md .