No receipts
An agent changes a setting or calls an internal service. Later, you need to know what it did, which policy allowed it, and whether approval was required.
The Problem
Section titled “The Problem”AI agents work across software, operations, and everyday tasks. Without an enforced execution boundary, a prompt alone cannot limit which tools they use, what they can change, or what evidence remains.
No guardrails
You tell an agent not to expose customer data. A system prompt is only an instruction; the execution boundary needs to enforce the tools and scopes available to it.
No boundaries
You ask an agent to investigate an incident. It should gather the evidence you authorized, while changes to production remain behind their own policy and approval boundary.
LumenFlow provides a shared governance kernel and a separate Agent Runtime for governed agent execution. The kernel applies scope, policy, approvals, and evidence to calls dispatched through it; the Agent Runtime supplies governed turns and session workflows; domain packs supply the task types, tools, policies, and evidence for each kind of work. Software Delivery is one pack. Explore the domain-agnostic architecture and the Agent Runtime Pack.
Four Guarantees
Section titled “Four Guarantees”Structural properties of the kernel — enforced for every tool call dispatched through it.
Agents stay in their lane
A 4-level scope intersection checks workspace, lane, task, and tool permissions before a dispatched tool call proceeds. All four levels must agree. One “no” and it’s blocked.
Every dispatched action has a receipt
Immutable, content-addressed evidence records capture what was requested, what was checked, and what happened. Not logs — tamper-evident records (unkeyed SHA-256 content addressing) that detect accidental change, independently of what any agent reports.
Policies can't be loosened
The deny-wins cascade means a restrictive policy at any level stays restrictive. A lane can’t override a workspace rule. Strictness only goes one direction.
Kernel tool dispatch is confined
LumenFlow’s own kernel tool dispatch runs pack subprocess tools in a bubblewrap sandbox with
write confinement and deny overlays on secrets — on Linux, today. Your coding-agent session runs
with your own authority unless you start it in an opt-in LumenFlow box (Linux only, wu-sandbox --box); enable your agent host’s own sandbox otherwise. On Linux, a repository can require
boxed sessions. See Agent safety.
Works With Any AI
Section titled “Works With Any AI”No tool lock-in. If your AI can read files and run commands, it can use
LumenFlow. LUMENFLOW.md is the sole managed agent contract; agents read
LUMENFLOW.local.md afterwards when it exists. If your tool needs its own
project discovery file, keep it as a project-owned pointer to those documents.
LumenFlow does not generate or synchronize tool-specific formats.
Find Your Workflow
Section titled “Find Your Workflow”The kernel is domain-agnostic. Packs add domain tools, policies and evidence. The catalog lists twelve offerings: software delivery, workspace productivity, agent execution, campus operations, reliability investigation, security assurance, data analytics, customer support, and the Knowledge, Protocol Adapters, App Backends and App Delivery libraries.
Use each catalog row’s availability and runtime status to distinguish existing implementations, enabling libraries and planned offerings, and explore consumer configuration and the future commercial boundary.
Software Delivery Pack
Ships built-in. Work Units, lanes, gates, worktrees, memory, flow metrics, and 100+ CLI commands for structured software delivery. This is what we use to build LumenFlow itself.
Sidekick Pack
Ships built-in. Workspace-local tasks, memory, routines, channels, and status data under
.sidekick/ for lightweight productivity inside the governed runtime.
Build Your Own
Data pipelines, infrastructure, compliance, and other domains — if you can define the rules, you can build a pack for it.
Get Started
Section titled “Get Started”For Humans
Step-by-step setup for developers who want to govern their AI agents today.
For AI Agents
Canonical onboarding guide for AI coding assistants. Hand this to your agent and let it go.
Learn the Architecture
Read how the kernel enforces policy, the packs extend it, and the evidence store proves it.
See the FAQ
Short answers to the common questions — how LumenFlow compares, what it costs to run, and whether it fits your stack.