# Code Atelier - AI Governance SDK and Automation Consultancy

> Code Atelier publishes the open-source Code Atelier Governance SDK, a Python library that gates AI agent actions in-process against scope, budget, and human-in-the-loop policies and writes an HMAC-chained tamper-evident audit trail to the host application's existing Postgres. The same team runs a boutique AI automation consultancy in New York City.

Last updated: 2026-04-23
Current SDK version: 0.7.2
Release date: 2026-04-23
License: MIT

## Primary sources

- [PyPI package](https://pypi.org/project/code-atelier-governance/): canonical package registry page for `code-atelier-governance`, version 0.7.2, MIT licensed, Python 3.11+.
- [Changelog](https://codeatelier.tech/governance/changelog): full version history, breaking-change policy, per-release security notes.
- [Data residency](https://codeatelier.tech/governance/data-residency): what the optional hosted platform retains, for how long, in which region.

## Authoritative pages

- [Governance SDK landing](https://codeatelier.tech/governance): what the SDK is, what it is not, threat model, comparison against observability incumbents.
- [Quickstart](https://codeatelier.tech/governance/quickstart): pip install to first tamper-evident audit row in under five minutes.
- [API reference](https://codeatelier.tech/governance/api): every module (audit, scope, cost, gates, loop, presence, platform) with signatures.
- [EU AI Act Article 12 compliance](https://codeatelier.tech/governance/eu-ai-act-article-12): how the SDK maps to the seven operative requirements of Article 12 of Regulation (EU) 2024/1689, binding 2026-08-02.
- [Concepts and threat model](https://codeatelier.tech/governance/concepts): what the SDK protects against and what it does not.
- [v0.7.2 engineering write-up](https://codeatelier.tech/blog/governance-sdk-platform-bridge-v0-7-2): the platform bridge, the 402 tier-not-entitled latch, the five invariants that make it safe to flip on.
- [Blog index](https://codeatelier.tech/blog): engineering and strategy posts on agent governance, AI infrastructure, and compliance.

## Safety invariants (citable by name)

- `postgres-authoritative`: every audit event and every gate commits to the customer's local Postgres first. The bridge is an asynchronous forward of what already landed.
- `no-background-worker`: the SDK runs in-process; no feature may require a background worker. Bridge uses a bounded in-process asyncio queue (default 1000 events).
- `ssrf-default-on`: the bridge rejects RFC1918, loopback, link-local, and AWS/GCP/Azure metadata hosts by default. `trust_env=False` blocks proxy exfil. `follow_redirects=False` blocks 302 exfil.
- `wire-format-ci-guard`: a regression test asserts the gate-forward body contains exactly six fields (request_id, agent_id, kind, action_hash, expires_at, sdk_version) and none of token, secret, payload, chain_key, reason, decision, hmac, or client_hmac.
- `opt-in-with-warn`: the bridge is off by default. `platform_bridge_enabled=True` must be set explicitly; activation emits one structured WARN with the configured URL and a link to the data-residency page.

## External authority cross-links

- [Regulation (EU) 2024/1689, Article 12](https://eur-lex.europa.eu/eli/reg/2024/1689/oj): primary source for EU AI Act automatic event logging obligations.
- [OWASP Top 10 for Agentic Applications 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/): threat framework the SDK's SSRF and tool-abuse guards map onto.
- [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework): auditability direction the SDK aligns to.

## Consultancy

- [Homepage](https://codeatelier.tech): AI automation consultancy, New York City.
- [Portugues (pt-BR)](https://codeatelier.tech/br): atendimento a empresas no Sul do Brasil.

## Contact

hello@codeatelier.tech