A dated capability comparison. Every capability and scope statement below was taken from the linked project documentation as reviewed in June 2026, with the closest peers re-read on 2026-08-26 and the Anthropic auto-mode entry on 2026-09-22; re-check the current documentation before citing, capabilities change. This page maps layers and documented scope differences; it is not a ranking, and it makes no market-exhaustiveness claim.
Short answer: the category is active and filling fast. Most adjacent tools cover a different layer (orchestration, content filtering, evaluation, observability), and documented peers exist (AEGIS, Microsoft's toolkit, and the authorization-and-receipt projects listed under the closest peers). No equivalent small zero-dependency Python library with this exact contract was identified in the documents reviewed (a documentation review of the projects listed here, not an exhaustive market search), and Recusal is new and unproven while several of these are mature, widely-used projects. Deterministic pre-execution refusal is now shared ground, not a differentiator; the documented difference is scope and size, and that is the only claim this page makes.
- Microsoft Agent Governance Toolkit: open-sourced Apr 2, 2026; "runtime security for AI agents." blog · repo
- Galileo Agent Control: "write behavioral policies once, enforce across deployments." coverage
- OWASP Agentic Top 10 is now the reference risk taxonomy.
- The recurring theme across 2026 write-ups on agent governance is that responsible AI is increasingly enforced at runtime through infrastructure-level controls rather than in policy documents (our synthesis of the sources above and the emerging-peer projects below, not a single attributable quote). That runtime-enforcement angle is the one Recusal takes.
- Regulatory note: EU AI Act high-risk obligations were slated for Aug 2, 2026, but the Digital Omnibus (agreed May 2026) defers them to Dec 2, 2027. Recusal claims no compliance status under any framework. timeline · deferral
Recusal's four ideas: (1) independent refusing verifier · (2) deterministic failure-classification + routing · (3) runaway/bounded-autonomy controls · (4) constitutional separation-of-powers model.
These build and run agents; adjudication is a different job. All are mature, widely-used tools, and the notes below describe their documented governance surfaces, not an absence of others.
| Project | How its focus differs from Recusal |
|---|---|
| AutoGen | "critic" patterns are in-process and LLM-graded, not a separate deterministic authority. |
| CrewAI | max_iter bounds loops; no deterministic verifier or failure-router. |
| OpenAI Agents SDK | max_turns, plus (re-read 2026-08-26) native tool guardrails and needs_approval gates. Per its guardrails page, "Tool guardrails apply only to function tools created with function_tool"; hosted tools (web search, file search, hosted MCP, code interpreter, image generation) and built-in execution tools (computer, shell, apply_patch, local shell) "do not use this guardrail pipeline", while approvals do reach shell, apply_patch and hosted MCP. An in-framework seam, not a separate authority. |
| Pydantic AI | output schema validation, not evidence adjudication. |
| LangGraph | closest in spirit (retry/rollback nodes), but governance is hand-rolled, not packaged. |
- Guardrails AI: output validation (RAIL validators).
- NVIDIA NeMo Guardrails: Colang conversation rails.
- Llama Guard (a probabilistic safety classifier) / LlamaFirewall: an open-source guardrail framework (PromptGuard 2 jailbreak detection, Agent Alignment Checks over chain-of-thought, and CodeShield static analysis), broader than a single classifier.
- Invariant Labs: rule-based guardrail proxy; closest to "intercept and block," but a security gate, not a refusing certifier or failure-router.
- promptfoo, DeepEval, Inspect AI, Ragas, OpenAI Evals.
⚠️ Verdict (Haize Labs): "scaling judge-time compute," a compound LLM-as-judge, a probabilistic verifier where Recusal's is deterministic (and it owns the name "Verdict", which is why this library is not called that).
Observability, primarily records and analyzes execution (verify each product's current enforcement features before a categorical comparison)
- Langfuse, Arize Phoenix, AgentOps, Helicone. Passive telemetry.
- Microsoft Agent Governance Toolkit (re-read 2026-08-26; MIT; v4.1.0 on 2026-06-09; its releases page states "Public Preview ... may have breaking changes before GA"): a multi-package, multi-language platform (Agent OS / Mesh / Runtime / SRE / Compliance / Marketplace / Lightning / Agent Hypervisor / Agent Control Specification; Python/TS/Rust/Go/.NET). Its Agent OS kernel (
pip install agent-os-kernel) does package a pre-execution refuser: per its documentation, "Actions are intercepted and validated before execution, making enforcement deterministic", with a verdict object and actions reported as blocked, delegation with trust-ceiling propagation, and a hash-chained ("Merkle") audit ledger. An earlier revision of this page said it did not package a refusing adjudicator; that was wrong at least as of this re-read and is withdrawn. What it does not package, per the same docs, is (2) deterministic failure-classification to remediator routing or (4) a separation-of-powers model, and its stateless API is "zero dependencies beyond Pydantic" where Recusal's kernel has none. It is OWASP/policy-engine framed and platform-scale, the opposite of a small kernel; deterministic refusal is shared ground. - Agent Passport System (read 2026-08-26; Apache-2.0; TypeScript reference with Python and Go): "Cryptographic identity, scoped delegation that narrows per hop, gateway enforcement, signed receipts for every action", with "a 3-signature action chain: agent signs intent, policy engine signs evaluation, agent signs execution receipt" and "Sub-delegation can only reduce scope." It is the closest documented peer for authorization evidence and decision receipts. Recusal does not implement identity, key management, or delegation issuance; it adjudicates evidence an adopter supplies and binds the decision to a digest, not a signature.
- Dogwood (read 2026-08-26; Apache-2.0; Rust): "Reference parser and interpreter for the Dogwood policy language", Cedar extended with temporal conditions ("since, formerly, once") and aggregations over an agent's recent event history; its README states it is "NOT intended for production use". A policy language for sequences of tool calls, with no envelope or receipt format of its own.
- AEGIS (github): an OSS agent-firewall whose documentation describes pre-execution policy enforcement (YAML/AJV DSL), deterministic blocking, hash-chained + Merkle audit, a kill switch, and Claude Code + MCP adapters. Recusal does not compete on feature count; the documented difference in scope is Recusal's small zero-dependency evidence-to-verdict contract and independent-refusal framing. Verify AEGIS's current capabilities from its own documentation before comparing.
- Anthropic's Claude Code auto mode: a same-family safety layer: an injection probe on tool output plus a Sonnet-class transcript classifier judging actions pre-execution, with an admitted 17% false-negative rate and Anthropic's own note that it is "not a drop-in replacement for careful human review on high-stakes infrastructure." Since that post, auto mode has become the built-in starting permission mode on Pro, Max, and Team plans, and its classifier runs server-side by default for Claude API and Enterprise users (permission modes, Claude Code 2.1.278); the structure is unchanged: a separate classifier model reviews each action. This is the conflict of interest Recusal exists to remove, a model from the same family grading the same family. In "Trustworthy agents in practice" Anthropic also states the security of agents "cannot be achieved by any single company".
- "AgentCity: Constitutional Governance for Autonomous Agent Economies via Separation of Power" (arXiv, an on-chain governance model); "Beyond Autonomy: A Dynamic Tiered AgentRunner" puts proposal, review, execution, and verification in independent agents with physically isolated boundaries (arXiv): conceptual overlap, but framework papers, not libraries.
- LawClaw: a single self-governing agent with a
constitution.md+ judicial layer; closest in spirit to #4, but a demo agent, not a reusable governance library.
Different tools solve different parts of the problem. This is a map of layers, not a ranking, and Recusal is the new, unproven entry here; several of the others are mature and widely used.
| Layer | What it does | Where Recusal sits differently |
|---|---|---|
| Agent frameworks | build and orchestrate agents | doesn't orchestrate; adjudicates a proposed action |
| Guardrails | filter input/output content | judges the work product or action, not the text |
| Eval libraries | score offline, often LLM-as-judge | decides in the live action path, deterministically |
| Observability | record what happened | can refuse before the action runs |
| MS Toolkit | enterprise governance platform, deterministic pre-execution refusal included | a small zero-dependency kernel, not a platform; refusal itself is shared ground |
| Agent Passport System | signed identity, narrowing delegation, signed receipts | adjudicates supplied authority evidence; digest-bound receipt, no identity or keys |
| Dogwood | Cedar-family policy language with temporal conditions | evidence-to-verdict contract, not a policy language |
| Anthropic auto mode | same-family safety classifier | no model in the decision path |
| AEGIS | agent firewall: enforce + audit (per its documentation) | a documented peer; Recusal's difference is the small deterministic evidence-to-verdict contract, not feature parity |
Frameworks build, guardrails filter, evals score, observability records, and the safety layer that ships with an agent is, by construction, a model from the same family judging that family. Documented OSS peers exist (AEGIS especially), so this is a differentiation question, not an empty category. Recusal's bet is narrow: an independent, deterministic authority in the action path that can refuse, with no model in the decision and a kernel deliberately small. Whether that is worth adopting over a more featureful peer is a fair question to ask of a new, early-stage library.