Quickstart: Python

Wire wytness_ai into your AGT-instrumented agent in about five minutes. Install, set four env values (plus the optional endpoint), call wytness_ai.init(). Every audit entry AGT chains is auto-forwarded to Wytness with PII pseudonymisation and a per-event Ed25519 envelope signed with your customer-held key.

1. Install the wrapper

Microsoft's Agent Governance Toolkit (AGT) is a hard dependency of wytness-ai — installed automatically. One command gets you the open-source identity, hash-chain, and policy primitives, plus the Wytness compliance layer on top.

1pip install wytness-ai

2. Generate keys

Wytness adds two customer-held primitives on top of AGT — per-event Ed25519 non-repudiation and zero-knowledge PII pseudonymisation. Both rely on keys you generate in your browser; the private halves never reach Wytness.

Open the Keys page. Click Generate on each of the Signing, Encryption, and HMAC tabs, then download each private half. The public halves auto-register against your org. The four env values you need are then shown as a copy-block on the Onboarding "Instrument" step:

• WYTNESS_API_KEY — transport credential (server-issued, prefix wyt_api_live_…)
• WYTNESS_SIGNING_KEY — base64 Ed25519 private key, 32 bytes decoded (always required — non-repudiation is the product promise)
• WYTNESS_PII_PUBKEY — base64 X25519 public key, 32 bytes (optional; required together with the secret to enable PII pseudonymisation)
• WYTNESS_PII_SECRET — base64 HMAC secret, ≥16 bytes (optional; required together with the pubkey)

3. Set the environment

Set the four values as environment variables. In production use your secrets manager (Azure Key Vault, AWS Secrets Manager, Vercel env, k8s secrets, etc.); in local dev a .env file loaded by python-dotenv is fine. wytness_ai.init() reads them directly — no constructor boilerplate. If you use a .env file locally, add it to .gitignore before the first git add.

1WYTNESS_API_KEY=wyt_api_live_...
2WYTNESS_ENDPOINT=https://api.wytness.ai
3WYTNESS_SIGNING_KEY=<base64 Ed25519 private key>
4WYTNESS_PII_PUBKEY=<base64 X25519 public key>
5WYTNESS_PII_SECRET=<base64 HMAC secret>

4. Wire it in

Call wytness_ai.init() once at process start, before AGT's AuditLog is first instantiated. The wrapper hooks AGT's audit log cleanly so every entry it chains flows through the Wytness path — your existing AGT code stays unchanged.

1import wytness_ai
2from wytness_ai import AuditLog
3 
4# Reads WYTNESS_* env vars by default. pii_fields lists the dotted paths
5# whose values should be pseudonymised (emails, customer names, etc.).
6wytness_ai.init(pii_fields=["customer.email", "customer.name"])
7 
8audit = AuditLog()
9audit.log(
10    event_type="tool_invocation",
11    agent_did="billing-agent",
12    action="send_invoice",
13    policy_decision="allow",
14    data={
15        "customer": {"email": "alice@example.com", "name": "Alice"},
16        "amount": 99.99,
17    },
18)
19 
20# Drain the in-flight batch on exit.
21wytness_ai.shutdown()

5. Run it

Run your agent normally. The wrapper batches events (default 100 or 5 seconds, whichever first), pseudonymises declared PII fields, signs each event with your Ed25519 key, and POSTs the canonical-shape envelope to api.wytness.ai/ingest. Failed POSTs are written to a local dead-letter file for replay once connectivity returns.

1python agent.py

Open your app.wytness.ai dashboard within ~5 seconds of the first event to confirm it arrived. Events show the AGT identity, the AGT-supplied hash chain, and the Wytness envelope signature side-by-side.

What you'll see in the dashboard

• Each AGT AuditEntry as a row in the Events page
• Three-layer verdict: AGT identity (Ed25519 DID), AGT-supplied hash chain, Wytness envelope (Ed25519)
• PII fields rendered as typed tokens (EMAIL_3c866e6f, etc.); reveal in-browser with your X25519 private key
• Source format chip showing wytness_agt_py (Python wrapper) on every event
• Per-agent Identity Badge pulled from AGT's DID + trust score

Full working example

Save as test_audit.py, then run with python test_audit.py.

1import wytness_ai
2from wytness_ai import AuditLog
3 
4wytness_ai.init(pii_fields=["customer.email"])
5 
6audit = AuditLog()
7 
8audit.log(
9    event_type="tool_invocation",
10    agent_did="test-agent",
11    action="hello_world",
12    policy_decision="allow",
13    data={"customer": {"email": "alice@example.com"}, "message": "Hi"},
14)
15 
16audit.log(
17    event_type="tool_invocation",
18    agent_did="test-agent",
19    action="add_numbers",
20    policy_decision="allow",
21    data={"a": 40, "b": 2, "result": 42},
22)
23 
24wytness_ai.shutdown()
25print("Done — check your dashboard.")

What happens under the hood

1. AGT runs unchanged — identity check, policy evaluation, hash-chain entry
2. The wrapper's WytnessAuditSink receives the entry, applies your pii_fields pseudonymisation
3. The canonical-shape data payload is signed with your Ed25519 key, wrapped in a CloudEvents 1.0 envelope
4. The batch is POSTed to api.wytness.ai/ingest as application/vnd.wytness.agt+json
5. Failed POSTs are written to a local dead-letter file for replay once connectivity returns

Automatic LLM capture

Prefer not to write AuditLog().log(...) by hand? Point init() at your model client with wrap= and every Anthropic Messages API call (including the beta namespace) and every OpenAI Chat Completions and Responses call — streaming included — is recorded automatically — prompt, reply, reasoning (Anthropic extended thinking), latency, and token usage. Token usage needs no opt-in: on OpenAI streams the SDK requests it and hides the resulting usage-only chunk, so your loop is unchanged. Other providers are not captured. Captured calls ride the same signed, PII-pseudonymised path as manual entries.

1import anthropic
2import wytness_ai
3 
4wytness_ai.init(
5    wrap=anthropic,  # or "openai", a list, or True to auto-detect installed providers
6    agent_did="did:web:acme.example:support-bot",
7    pii_fields=["customer.email"],
8)
9 
10client = anthropic.Anthropic()
11client.messages.create(  # recorded automatically — no audit.log() needed
12    model="claude-haiku-4-5",
13    max_tokens=512,
14    messages=[{"role": "user", "content": "Summarise ticket #4821"}],
15)
16 
17wytness_ai.shutdown()

Using LangChain, CrewAI, or another framework?

AGT 4.1.0 ships 12 first-party framework integrations: LangChain, LangGraph, CrewAI, Haystack, MCP, Flowise, Langflow, Swarm, A2A, AI Card, plus HTTP and Django middleware. These adapters perform trust verification (gating tool execution against trust scores) — for audit emission, the wrapper picks up every entry AGT's AuditLog().log(...) chains regardless of how you wired AGT in. See the framework integrations guide for the wire-up pattern.

Next steps

• PII Protection — declare custom pseudonymisation fields, generate keys, reveal tokens in the dashboard
• SDK API reference — full init() / shutdown() options, manual wiring, batch tuning
• Event schema — canonical-shape data payload + Wytness envelope layout
• Quickstart (TypeScript) — same shape for @wytness/ai (npm)