Governed Embodied Agent Lab

A runnable reference environment for testing runtime policy, human approval, state continuity, and tamper-evident evidence in simulated robot tasks.

Most robot demos ask whether the machine completed its task. This lab asks a different set of questions:

• Was the robot identified?
• Was the action permitted in the observed physical context?
• Was human approval required and bound to the exact action?
• Did governance state survive a controller restart?
• Can the resulting action record be checked for tampering?

See it run

The demo moves a robot from a green zone into a controlled zone, then requests entry into a restricted zone. The restricted move requires human approval. Execution continues after the controller is recreated, and replaying the same approval is blocked.

Quickstart

No external runtime services or Python dependencies are required.

git clone https://github.com/carloshvp/governed-embodied-agent-lab.git
cd governed-embodied-agent-lab

python3 -m venv .venv
source .venv/bin/activate
python -m pip install -e .

governed-agent demo

Expected result:

1. Observe workspace      executed
2. Enter controlled zone  executed
3. Request restricted move approval_required
4. Human approval issued
5. Execute after restart  executed
6. Replay same approval   blocked
7. Verify evidence chain  True (verified 17 records)

The full evidence ledger is written to demo-output/evidence.jsonl.

What version 0.1 demonstrates

Trusted context

The policy does not trust an agent-supplied zone label. The simulator derives the destination zone and object class from its own world state before policy evaluation.

Fail-closed policy

Unknown actions, unmatched rules, excessive speed, missing identity, and policy errors are denied.

Action-bound approval

Approval is cryptographically bound to:

• The exact action and parameters
• The robot principal
• The session
• The policy version
• Environment-derived facts
• The current world-state digest

Tokens expire, survive restart, and can be consumed only once.

Evidence continuity

Requests, decisions, approvals, execution results, and blocked actions are stored in a SHA-256 hash chain. The verifier detects edits, deletion, reordering, and broken links inside the chain.

Scenario

x = 0                 x = 1                   x >= 2
GREEN ZONE     ->     CONTROLLED ZONE   ->   RESTRICTED ZONE
start                 normal move             human approval

The world also contains:

• An approved blue-crate
• An unknown unlabeled-case
• Policy paths for observe, move, pick, place, and emergency stop

Policy example

The default policy is plain JSON so the control logic stays visible:

{
  "id": "restricted-zone",
  "action": "move",
  "effect": "require_approval",
  "conditions": [
    {
      "field": "facts.zone",
      "operator": "equals",
      "value": "restricted"
    },
    {
      "field": "parameters.speed",
      "operator": "lte",
      "value": 0.5
    }
  ]
}

See policies/default.json for the complete policy.

Evidence record

Each JSON Lines record contains:

{
  "sequence": 8,
  "timestamp": "2026-06-12T12:00:00+00:00",
  "event_type": "approval.issued",
  "payload": {
    "approver": "human:safety-operator",
    "action_digest": "...",
    "context_digest": "...",
    "rule_id": "restricted-zone"
  },
  "previous_hash": "...",
  "hash": "..."
}

Verify any generated ledger:

governed-agent verify demo-output/evidence.jsonl

Tests

python -m unittest discover -s tests -v

The test suite covers:

• Allowed movement
• Approval-gated restricted movement
• Restart with preserved approval and evidence state
• One-time approval and replay rejection
• Approval rejection after action changes
• Approval rejection after world-state changes
• Missing-identity denial
• Excessive-speed denial
• Evidence tamper detection

GitHub Actions runs the suite on Python 3.11, 3.12, and 3.13.

Project structure

policies/default.json       Fail-closed action policy
src/.../policy.py           Policy evaluation
src/.../approval.py         Bound, signed, one-time approvals
src/.../simulation.py       Persistent deterministic robot world
src/.../controller.py       Governance and execution pipeline
src/.../evidence.py         Hash-chained JSONL evidence
tests/                      Governance regression tests
docs/                       Architecture and demo visuals

Limitations

This is a governance reference implementation, not a certified safety controller.

• The world is a deterministic 2D simulation, not a physics engine.
• The local approval key is file-backed rather than HSM-backed.
• The policy evaluator is intentionally small and is not OPA or Cedar.
• Telemetry uses structured JSON rather than an OpenTelemetry exporter.
• There is no ROS 2 adapter, hardware interlock, or real emergency-stop path.
• The evidence chain is tamper-evident, not independently witnessed.
• Detecting tail truncation requires an externally stored checkpoint.

These boundaries are deliberate: version 0.1 isolates the governance mechanics before adding robotics infrastructure.

Roadmap

• 0.2: OpenTelemetry export, signed evidence bundles, and incident replay
• 0.3: Fault injection and governance metrics
• 0.4: ROS 2 adapter and MuJoCo scenario
• 0.5: Independent policy engine and external approval service

Research map

The standards, tools, and evaluation work behind the lab are curated in Awesome Embodied AI Governance.

Author

Built by Carlos Hernandez, focused on governable autonomy across enterprise agents and embodied systems.