A production-ready example demonstrating multi-agent collaboration with MeshGuard permission governance. This research team showcases delegation chains, permission ceilings, and audit logging.
┌─────────────────────────────────────────────────────────────────────────────┐
│ MeshGuard Policy Layer │
│ ┌─────────────────────────────────────────────────────────────────────┐ │
│ │ research-team.yaml │ │
│ │ • Defines trust tiers (verified, trusted) │ │
│ │ • Permission ceilings enforce delegation limits │ │
│ │ • Audit logging tracks all agent actions │ │
│ └─────────────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────────────────────────────────────────────┐
│ CrewAI Research Team │
│ │
│ ┌──────────────┐ delegates ┌──────────────┐ │
│ │ Researcher │ ─────────────────▶ │ Analyst │ │
│ │ (verified) │ │ (trusted) │ │
│ │ │ │ │ │
│ │ Permissions: │ │ Permissions: │ │
│ │ • web_search │ │ • analyze │ ◀─┐ │
│ │ • delegate │ │ (ceiling: │ │ cannot exceed │
│ └──────────────┘ │ researcher) │ │ delegator's │
│ │ └──────────────┘ │ permissions │
│ │ │ │ │
│ │ passes findings │ │ │
│ ▼ ▼ │ │
│ ┌──────────────┐ ┌──────────────┐ │ │
│ │ Writer │ ◀───────────────── │ Reviewer │ ──┘ │
│ │ (verified) │ review feedback │ (trusted) │ │
│ │ │ │ │ │
│ │ Permissions: │ │ Permissions: │ │
│ │ • write_doc │ │ • review │ │
│ │ • read_files │ │ • approve │ │
│ └──────────────┘ └──────────────┘ │
│ │ │
│ ▼ │
│ ┌──────────────┐ │
│ │ outputs/ │ Final research reports │
│ └──────────────┘ │
└─────────────────────────────────────────────────────────────────────────────┘
MeshGuard enforces permission ceilings in delegation chains:
Researcher (verified) ──delegates──▶ Analyst (trusted)
│ │
│ has permissions: │ receives permissions:
│ • web_search │ • analyze (own)
│ • delegate │ • web_search (inherited)
│ • read_files │ ↑ CEILING: cannot use
│ │ permissions Researcher
│ │ doesn't have
▼ ▼
If Analyst tries to use 'write_doc' → DENIED
(Researcher doesn't have write_doc, so Analyst can't either)
# Clone and navigate
cd crewai-research-team
# Copy environment template
cp .env.example .env
# Edit .env with your API keys
# Run with Docker Compose
docker-compose up# Create virtual environment
python -m venv venv
source venv/bin/activate # or `venv\Scripts\activate` on Windows
# Install dependencies
pip install -r requirements.txt
# Set up environment
cp .env.example .env
# Edit .env with your API keys
# Run the research crew
python main.py| Variable | Description | Required |
|---|---|---|
OPENAI_API_KEY |
OpenAI API key for LLM | Yes |
MESHGUARD_API_KEY |
MeshGuard API key | Yes |
MESHGUARD_ENDPOINT |
MeshGuard server URL | Yes |
SERPER_API_KEY |
Serper API for web search | Optional |
LOG_LEVEL |
Logging verbosity | No (default: INFO) |
The policy at policies/research-team.yaml defines:
- Trust Tiers:
verifiedandtrustedwith different permission sets - Delegation Rules: Which agents can delegate to whom
- Permission Ceilings: Inherited permission limits
- Audit Requirements: What actions get logged
Run the crew with different research topics:
# In main.py, modify the topic:
topic = "The impact of AI on healthcare diagnostics in 2024"
topic = "Sustainable energy storage solutions comparison"
topic = "Remote work productivity trends post-pandemic"
topic = "Quantum computing applications in cryptography"Or pass via command line:
python main.py --topic "Your research topic here"crewai-research-team/
├── README.md
├── requirements.txt
├── .env.example
├── docker-compose.yml
├── Dockerfile
├── main.py # Entry point
├── crew.py # CrewAI crew definition
├── agents/
│ ├── __init__.py
│ ├── researcher.py # Web research agent (verified)
│ ├── analyst.py # Data analysis agent (trusted)
│ ├── writer.py # Content writing agent (verified)
│ └── reviewer.py # Quality review agent (trusted)
├── tools/
│ ├── __init__.py
│ ├── web_search.py # Governed web search
│ ├── document_writer.py # Governed document creation
│ └── data_analyzer.py # Governed data analysis
├── policies/
│ └── research-team.yaml # MeshGuard governance policy
├── tasks/
│ ├── __init__.py
│ └── research_tasks.py # Task definitions
└── outputs/
└── .gitkeep # Generated reports go here
Each tool is wrapped with MeshGuard governance:
from meshguard import GovernedTool, require_permission
@require_permission("web_search")
class WebSearchTool(GovernedTool):
def _run(self, query: str) -> str:
# MeshGuard checks permission before execution
# Audit log records the action
...When Researcher delegates to Analyst:
# In crew.py
researcher.delegate_to(
analyst,
permissions=["analyze"], # Explicit delegation
ceiling=True # Analyst can't exceed Researcher's permissions
)All actions are logged with full context:
{
"timestamp": "2024-01-15T10:30:00Z",
"agent": "researcher",
"action": "delegate",
"target": "analyst",
"permissions_granted": ["analyze"],
"ceiling_applied": true,
"delegation_chain": ["researcher", "analyst"]
}- Create agent file in
agents/ - Define trust tier in
policies/research-team.yaml - Add to crew in
crew.py - Define tasks in
tasks/research_tasks.py
- Create tool file in
tools/ - Wrap with
@require_permissiondecorator - Add permission to policy
- Assign to appropriate agents
Modify policies/research-team.yaml to:
- Add new trust tiers
- Change permission assignments
- Adjust delegation rules
- Configure audit levels
MeshGuardError: Agent 'analyst' denied permission 'write_doc'
Reason: Permission ceiling exceeded (delegator 'researcher' lacks 'write_doc')
Solution: Check the delegation chain and ensure the delegating agent has the required permission.
Logs are written to:
- Console (configurable via
LOG_LEVEL) outputs/audit.log(JSON format)- MeshGuard dashboard (if connected)
MIT License - See LICENSE file for details.