Brevet
AI agents change as they work. You need to know whether those changes make them better, who approved them and how to take them back. Brevet is an open-source Python runtime that brings change control to that evolution.
01 / What it is
Brevet brings change control to AI agents that work alongside people. It keeps two versions of each agent apart: the release doing the work, and the changes proposed for the next one.
A change reaches the agent only after a named person approves it and it passes the release checks. Each release records what changed, the evidence behind it and who approved it, so a change that proves wrong can be traced and withdrawn.
The version doing the work
Signed, with its approvers and test evidence
Changes for the next release
Reaches the agent only after both checks
02 / Why Brevet
A correction that is right for one task can be wrong for the next. A reviewer raises the severity of a pump fault because she suspects seal wear. If a faulty sensor turns out to be the cause, the team must stop the agent applying that lesson.
Before an agent’s lessons shape real work, the people responsible need three answers.
Every release lists each rule, where it came from and the set-up the agent runs with.
Each rule names the person or review group that approved it, with their signature once signing is on.
Recall the rule. Brevet stops serving it and flags every release that carried it.
03 / How it works
Brevet runs an agent’s learning on a daily rhythm. By day, the agent works and experts correct it. Overnight, Brevet studies the corrections and proposes changes. At dawn, people decide which ones the agent may use.
The agent works. Experts correct it.
The agent drafts under its signed release.
AgentAn expert fixes the draft and gives a reason.
ExpertOvernight, Brevet studies the corrections.
Recurring corrections become a proposed rule and tests, with no authority.
BrevetPeople decide what the agent may use.
A named person or review group promotes or rejects it.
PeopleThe corrections replay as tests. A change that scores worse is stopped.
BrevetApproved rules ship in a new signed release.
PeopleRecall at any time: withdraw a rule, and Brevet flags every release that carried it.
The two steps are kept apart on purpose: the process that finds a pattern cannot approve it.
Overnight
Brevet looks for corrections that keep recurring and turns them into a proposed rule.
In the morning
A named person or review group decides what happens to each proposal.
A worked example with signed approvals. At the Decide step, you make the call.
An agent rates equipment problems for a pharmaceutical quality team.
The agent rates pump vibration during cleaning as minor. The reviewer changes the rating to major, explaining that it may be a sign of seal wear. She makes this correction on four reports.
Four corrections recorded
The agent’s draft
The reviewer’s correction
Brevet records each correction, her reason and the original rating.
The corrections concern the same problem and give the same reason. Brevet groups them into a proposed rule and creates a test from each report. The agent continues using its existing release while the proposal waits for review.
Proposed · no authority
Treat pump vibration during cleaning as major and escalate for review.
This runs separately from live work, in a process Brevet calls Dream.
The agent attempts to approve the rule in its own name. Brevet refuses. Signed approvals are enabled in this example: a registered quality owner must sign for the review group. The agent can request a decision, but cannot supply that signature.
Waiting for human approval
Treat pump vibration during cleaning as major and escalate for review.
Without signed approvals enabled, Brevet checks the name supplied, not who supplied it. Here, it also verifies the reviewer’s signature. This approval step is called Dawn.
Brevet runs the four corrected reports against the original agent and an updated version that follows the rule. Both groups of tests improve, so the change passes the release check.
Tests passed · ready for release
Both test groups improve from 0/2 to 2/2. Release check passed.
These tests come from the same four corrections, split into two groups. The demo uses a stand-in agent with a programmed change; this result shows the release check working. Independent cases are needed to test whether the rule helps on new work or causes regressions.
After checking the test results, the quality owner signs the release approval for the review group. Brevet also signs the release manifest, which records the rule and the tests behind it.
Signed trial release · human review required
The agent receives the released rule with its tasks. Its drafts still require human review.
Engineers find that a faulty sensor caused the vibration reports. The quality group recalls the rule. Brevet stops supplying it to the agent and flags release 0.2.0, which included it.
Withdrawn · excluded from future releases
Treat pump vibration during cleaning as major and escalate for review.
The record retains the rule, the evidence behind it and the reason it was withdrawn.
Claude starts each summary with routine updates. You move the issues needing attention above them, making the same change in three summaries.
Three matching corrections
Claude’s draft
Your edited version
Claude records both versions and your reason through Brevet.
You ask Brevet to review the saved corrections. It finds the repeated change in structure and proposes a rule for weekly summaries.
Proposed · no authority
Put issues needing attention first in weekly summaries.
The Dream process produces a proposal for you to review before Claude uses it.
Review the rule. Approve it for future summaries, or hold it for more evidence.
Waiting for your approval
Put issues needing attention first in weekly summaries.
Brevet records your decision. This approval step is called Dawn.
You test the proposed change and supply the results to Brevet. Its release check requires neither test group to get worse and at least one to improve.
Results supplied by a person
In this workflow, you confirm the results; Brevet does not measure them automatically.
Once the supplied results pass the check, Brevet creates a signed trial release. Claude fetches the released rule at the start of the next session.
Documented workflow · trial release
This example describes the workflow; it has no captured test scores or release record.
If the rule stops being useful, you ask Brevet to withdraw it. Brevet stops supplying the rule and records your decision.
Withdrawn · no longer supplied
Put issues needing attention first in weekly summaries.
This is a recall. Claude is instructed to stop applying the rule and confirm that it has done so.
Adapted from the upstream pump example, with signed approvals captured in the site’s own run. Approval refusals return an error without adding a decision to the recorded history; those responses are shown separately. A trial release refused by the test gate is recorded with its test evidence.
Illustration · Pump example with signed approvalsView on GitHub →
In a second example, the updated agent handles vibration correctly but starts misclassifying labels it previously got right. Its test score falls, so Brevet refuses the trial release and records why.
Two matching corrections fall below this example’s threshold of three. Brevet proposes no rule. The corrections still become tests for review, and the agent’s behaviour stays unchanged.
A rule gains authority only through a recorded human decision.
Proposed by Dream. Never reaches the agent.
Where every proposal startsGuides the agent’s drafts. A person still checks each result.
Promoted by a person or review groupMay drive actions directly.
Promoted by a review group onlyA recalled rule leaves every future release, and each release that carried it is flagged.
Each entry carries the fingerprint of the one before it.
An edited or shortened history no longer matches, so the check fails. Where anchors are configured, the latest fingerprint is also kept outside the workspace, which catches even a rewritten record.
brevet verify intact
04 / Your agent
Brevet wraps the agent you already have. Your framework keeps running it, while Brevet checks each run, serves the approved rules and holds tool calls to what the release allows.
Is this the latest signed release, set up as recorded? On trial and production, an unreleased edit stops the run.
The approved rules for this kind of task go with it.
Your framework runs the agent as before, with its own model and tools.
Each tool call is checked against the permissions the release grants.
The draft, the rules it used and any correction join the record.
agent = brevet.wrap(my_agent)
Brevet recognises the framework from the agent object itself.
uvx brevet mcp
The assistant fetches its approved rules at the start of each session, and can record corrections, review proposals, release and recall.
brevet hook
Holds each tool call Claude Code makes to the permissions of the latest release, and asks you before a consequential one.
Another framework? Register one adapter class with brevet.register_adapter. Read how →
The release declares each tool’s tier, and Brevet checks every call against it. A tool the release does not declare is refused.
| Tier | ShadowWatched, not acted on | TrialLimited use | ProductionFull use |
|---|---|---|---|
| ReadLook something up | Allowed | Allowed | Allowed |
| SuggestDraft for a person | Allowed | Allowed | Allowed |
| ActChange something | Refused | Allowed | Allowed |
| Controlled actConsequential, such as a refund | Refused | Refused | A person grants each callGrant per call |
CHAP is a protocol for collaboration between people and AI agents. Brevet can use review decisions recorded in CHAP as evidence for proposed changes, and send its approval, release and recall records back to CHAP.
Read about CHAP →The repository’s Cowork example puts what Claude learns between sessions under the loop. Your corrections become proposals, you decide at dawn, and Claude receives rules only from a signed release.
See the example on GitHub →05 / For builders
Start with the demo in your terminal, or open the local playground in your browser. Both run on your machine with a stand-in agent.
Follow a proposed rule through approval, testing, release and recall.
brevet · Python 3.10+ · Apache-2.0
Packages: PyPI · MCP Registry
Open the documentation →pip install brevet brevet demo brevet playground
# Run after: pip install brevet
# Offline demo: a stand-in agent and four recorded corrections.
import os
import tempfile
from pathlib import Path
folder = Path(tempfile.mkdtemp(prefix="brevet-demo-"))
os.environ["BREVET_CONFIG_DIR"] = str(folder / "config")
import brevet
def triage_agent(report, context):
rules = context.get("brevet", {}).get("rules", [])
knows_rule = any("vibration-during-cleaning" in r["content"] for r in rules)
severity = "major" if knows_rule and "vibration" in report else "minor"
return f"severity: {severity}"
agent = brevet.wrap(triage_agent, workdir=folder / ".brevet")
reviewer = "human:quality_reviewer"
for pump in ["P-301", "P-302", "P-303", "P-304"]:
result = agent.run(f"Pump {pump}: vibration high during cleaning",
task_family="equipment_triage")
agent.record_final(result.task_id, "severity: major",
participant=reviewer,
rationale="Vibration during cleaning may indicate seal wear.",
tags=["vibration-during-cleaning"])
agent.dream()
candidates = agent.dawn()
rule = next(c for c in candidates if c.kind == "prompt_rule")
# This small demo records an approver name, without a human signature.
# See "Set up signed approvals" below for verified human decisions.
for candidate in candidates:
agent.dawn(decide=(candidate.capability_id, "promote"), approver=reviewer)
before = agent.evaluate(baseline=True)
after = agent.evaluate()
agent.release(to_version="0.2.0", channel="trial", approver=reviewer,
evals=(before, after))
agent.recall(rule.capability_id, issued_by=reviewer,
reason="The vibration reports came from a faulty sensor.")
ok, entries = agent.verify()
print(f"Evidence chain intact: {ok} ({entries} entries)")
print(f"Inspect the demo records in {folder}")
{"mcpServers": {"brevet": {
"command": "uvx", "args": ["brevet", "mcp"],
"env": {"BREVET_HOME": "/path/to/workspace"}}}}
Any MCP client, such as Claude Desktop, Claude Code or Cursor, can then record corrections, request approval, create releases, roll back changes, recall rules and check the record.
Brevet records and checks changes. You choose the reviewers, supply independent tests and connect it to the agent’s work.
| Area | Brevet provides | Your deployment supplies |
|---|---|---|
| Capture | Correction records from draft and final, import of CHAP review decisions, and learning only from the people the consent scope allows | Where drafts and finals come from, and who has consented. Until you name them, Brevet learns from every correction it records |
| Proposal | Grouping repeated corrections into proposed rules for review | Reviewers’ time and expertise |
| Approval | Named decisions, signed approvals with group thresholds, and key checks against an allowed-signers file or GitHub | Who the approvers are, and the source that vouches for their keys |
| Testing | Corrections compiled into tests, test runs tied to each release, and a gate on their scores | Independent test sets |
| Wrapped agents | Checks the signed release and the recorded set-up before execution. Outside shadow, the wrapper refuses a run that fails those checks. | Routing each agent run through the wrapper and naming the files it should check |
| Assistants using MCP | Checks the release and its rules before serving them to the assistant. It reports changes to the recorded set-up; MCP does not control the assistant’s entire execution. | Instructions for the assistant to fetch rules, respect their limits and acknowledge recalls |
| Tool calls | The tool broker checks calls it intercepts against the declared tiers. Claude Code can use a separate hook to check its tool calls. Policy refusals are recorded when the check runs with a writable record. If the hook cannot open its workspace, it blocks the call but cannot record it there. | Declaring tool tiers, connecting the broker or Claude Code hook, and covering other execution paths |
| Recall | Withdrawal, flagging of releases, exclusion of the same content, and a confirmation from each agent Brevet serves | Agents that run outside the wrapper or MCP |
| Records | A hash-linked record in the workspace, anchored outside it where anchors are configured, with optional mirroring to CHAP | An anchor the agent cannot write, such as another disk or a CHAP coordinator, and retention |
Without signed approvals, Brevet checks the identity supplied with a decision but does not verify who supplied it. Once you register the first approver, every approval decision, release, rollback and recall requires a registered person’s signature. Their signing key is protected by a passphrase and kept outside the workspace. You can also specify an allowed-signers file or GitHub in the manifest to restrict which keys Brevet accepts for each person.
Anyone can ask for a decision, an agent included. An assistant connected through MCP gets back a request and a command for a person to sign it. A review group, called a mission group in the code, requires one member’s signature by default. You can raise that threshold to require more. Once it is raised, no single member can lower it, change the members or replace another member’s key.
brevet approver add --identity human:quality_owner --group mission_group:quality_team brevet approver add --identity human:second_reviewer --group mission_group:quality_team brevet dawn --decide cap_0ae432235901:promote --approver mission_group:quality_team brevet approve req_7f3a9c2e41d0 brevet approver threshold --group mission_group:quality_team --count 2
See what a release lists, how it is signed, what a recall records and how the record checks out. The records below come from the example run.
The rule’s entry, one of five, showing the identifier, kind, content fingerprint, authority level, approver and the four corrections behind it.
{
"approved_at": "2026-10-11T21:59:23.531248+00:00",
"approved_by": "mission_group:quality_team",
"authority_layer": "advisory",
"capability_id": "cap_f1a71350f45a",
"conditions_digest": "sha256:1b779a730990316ac4f1b927b05a517817441dbba681f42e8f8f3af100b7b3c8",
"content_hash": "sha256:4f89d8466d94fd24abec7c9580087bf5c8915d68b523f6daf26fbcb12106bfdf",
"evidence_refs": [
"ovr_ea5fd587d056",
"ovr_f8d9d0186167",
"ovr_eb67a2defb3a",
"ovr_e7ce6c7e23ec"
],
"kind": "prompt_rule",
"promotion_ref": null,
"revocation_status": "active"
}Two separate signatures: the reviewer’s signed release approval and the workspace signature over the release manifest, including the lockfile fingerprint.
{
"release_manifest_signature": {
"algorithm": "ed25519",
"content_hash": "sha256:6ff005efc1439ae568d8ece7121d31887b3545cad21d6f218ff6b13bf04157f3",
"public_key": "38c08b170af428e1b8ecc99bf8a54e84734c0a69c5f29d10cdf7a18b4e3dd552",
"signature": "bf2e62a4e807be3276a1af31068ae49af6f47fcdb5348ee196221ef2d8663bf9615118d685a11971983621245297573a3d35008fda4744e92a0bcb27a5b0210a",
"signed_at": "2026-10-11T21:59:23.591009+00:00",
"signed_by": "mission_group:quality_team",
"release": {
"channel": "trial",
"lockfile_hash": "sha256:16ae28474fc1daf9572fd29906d2a2e9b64a116c27834de41e4abf74a6293db5"
}
},
"human_release_approval": {
"payload": {
"agent": "deviation_triage_assistant",
"approver": "mission_group:quality_team",
"channel": "trial",
"delta_held_in": 1.0,
"delta_held_out": 1.0,
"evals": {
"after": "env_c3264cd972d2",
"before": "env_9c925037ed85",
"source": "measured"
},
"from_version": "0.1.0",
"kind": "brevet.release",
"lockfile_hash": "sha256:16ae28474fc1daf9572fd29906d2a2e9b64a116c27834de41e4abf74a6293db5",
"manifest_hash": "sha256:6ff005efc1439ae568d8ece7121d31887b3545cad21d6f218ff6b13bf04157f3",
"rationale": "",
"request_id": "req_2fa325352db7",
"requested_at": "2026-10-11T21:59:23.583155+00:00",
"restores": null,
"set_aside": null,
"to_version": "0.2.0"
},
"payload_hash": "sha256:e1701b5ac21224124a011860bfe839a53d736fd174b4079a671069d08141070c",
"signatures": [
{
"identity": "human:quality_owner",
"public_key": "dafddfb463cf49fc3c60cb778c8abbe3fd15e80e5907b550495adfda5af99f03",
"signature": "78e1089c9b0314cf96ed83bbcad20f7e4b62f591e647b9d93ea887d18a3eb8b993d8872de305633a39ae98e423dc78ead2277600716ec38858ff34f2987a0104",
"signed_at": "2026-10-11T21:59:23.584479+00:00"
}
]
}
}The reason, its class, the severity, the action and the release affected.
{
"action": "rollback",
"affected_releases": [
{
"agent": "deviation_triage_assistant",
"resolved_action": "rollback",
"resolved_at": "2026-10-11T21:59:23.601560+00:00",
"version": "0.2.0"
}
],
"approval": {
"payload": {
"action": "rollback",
"capability_id": "cap_f1a71350f45a",
"content_hash": "sha256:4f89d8466d94fd24abec7c9580087bf5c8915d68b523f6daf26fbcb12106bfdf",
"issued_by": "mission_group:quality_team",
"kind": "brevet.recall",
"reason": "The vibration came from a faulty sensor on the P-301 pump family.",
"reason_class": "incorrect",
"request_id": "req_38647fa498b9",
"requested_at": "2026-10-11T21:59:23.598039+00:00",
"severity": "high"
},
"payload_hash": "sha256:0ea65a3a4078109117f3f208bc4b11ff0e15a9d5ee15ffbf5b7afff6641e13d8",
"signatures": [
{
"identity": "human:quality_owner",
"public_key": "dafddfb463cf49fc3c60cb778c8abbe3fd15e80e5907b550495adfda5af99f03",
"signature": "9e390908c32a996c627a0426d884242dfbef72660408a4cba4dcd015517e9281d094e7107efa3d0b7e11cc146a4bcf806fb6a0827c2d77b7e03a7005480b450c",
"signed_at": "2026-10-11T21:59:23.599170+00:00"
}
]
},
"capability_id": "cap_f1a71350f45a",
"completed_at": "2026-10-11T21:59:23.601564+00:00",
"content_hash": "sha256:4f89d8466d94fd24abec7c9580087bf5c8915d68b523f6daf26fbcb12106bfdf",
"control_refs": [],
"issued_at": "2026-10-11T21:59:23.601576+00:00",
"issued_by": "mission_group:quality_team",
"reason": "The vibration came from a faulty sensor on the P-301 pump family.",
"reason_class": "incorrect",
"recall_id": "rcl_fabbdaef4d0d",
"severity": "high"
}Entry kinds and counts, and the replay result.
brevet.approver 1 brevet.artefact 16 brevet.candidate 1 brevet.eval_run 2 brevet.override 4 brevet.promotion 5 brevet.recall 1 brevet.release 1 brevet.task 14 brevet verify: intact, 45 envelopes
Today, Brevet turns repeated human corrections into rules that can be reviewed, tested, released and recalled. It also records the agent’s wider set-up, checks for changes and can restore archived releases and their named files.
| Change | Today |
|---|---|
| Rules an agent learns from repeated corrections | Brevet proposes each rule for a named person to review. Approved rules can be tested, released and recalled individually. |
| The rest of the agent’s set-up: its manifest, the files you name such as prompts, skills and tool code, and what the framework exposes, such as instructions, model name, tools and library versions | Fingerprinted and signed with each release. A release needs a named approver and, on trial or production, a passing gate. Outside the shadow channel, a wrapped agent stops if any of these changes before the next release, apart from library upgrades, which are recorded. These changes are not yet proposed or recalled one at a time. |
| Tool calls while the agent runs | Held to the tiers each release grants, once tools are declared. An undeclared tool is refused, a tool that acts never runs on the shadow channel, and the most consequential need a person’s grant for each call. This covers agents built with Claude Agent SDK, OpenAI Agents, LangChain, LangGraph, Pydantic AI and AutoGen, tools you mark in your own code, and Claude Code through a hook. |
| A vendor changing a model’s behaviour under the same name, and a hosted assistant’s own memory | Outside Brevet’s reach. |
06 / Research
Brevet investigates how change control can apply to agents that learn from their work. Its open-source runtime puts that research into practice: people review proposed changes, test their effects and keep a record they can use to withdraw a change later.
Brevet: Change Control for What Self-Evolving AI Agents Learn
The paper is the academic account of Brevet. It explains why agents that learn from their work need change control, how the governed evolution loop turns experts’ corrections into rules, the levels of authority a rule can hold and the decisions reserved for people.
The repository sets out a benchmark design that measures improvement, regressions, the record behind each change and whether recalled capabilities stop being used. Brevet can already score a workspace’s record. The design also specifies shared datasets and comparisons with other approaches.
07 / FAQ
About the idea
No. It leaves the model’s weights alone and works on the agent around them: today, the rules the agent learns and the set-up recorded with each release.
No, not yet. Rules an agent learns from corrections go through the full loop. Changes to the rest of its set-up are fingerprinted and signed with each release. Outside shadow mode, a wrapped agent stops if they change before the next release under the default policy. Library upgrades are recorded without stopping it. Some changes are outside its reach, such as a vendor changing a model under the same name. What you can do today, under For builders, sets this out.
Brevet proposes rules from people’s corrections and supplies released rules to the agent with each task. It records the approvals and tests behind those rules. The agent must be able to use them; Brevet does not change its model or write new agent code.
The release check compares two groups of tests before and after the change. Neither group’s score may fall, and at least one must improve. Brevet links the runs to the release and checks them against the record. Results supplied without runs are recorded as human-confirmed results; production releases require runs by default. Tests built from corrections alone can miss mistakes on work the agent previously got right. Use independent test sets to check for those regressions.
They name the loop’s daily rhythm. Overnight, Dream studies the day’s corrections and proposes rules and tests, with no authority. At dawn, people review the proposals and decide which ones the agent may use. Only what they approve, and what then passes its tests, reaches the agent in a signed release.
About people
Not in its own name. Approvals in the name of an agent, a model or the overnight process are refused. With signed approvals switched on, only a registered person can sign, and an agent can only ask.
It is withdrawn, every release that carried it is flagged, and the same content cannot come back under a new name. Agents that take their rules from Brevet stop receiving it and confirm that on the record. An assistant connected through MCP confirms it itself. Rollback restores an archived release: its manifest, the files you named and its rules, minus any recalled since. It returns to that release’s channel or a lower one; moving to a wider channel needs a new release with its own evidence. The agent’s own code comes back from your version control.
About building
Brevet wraps agents built with LangGraph, Claude Agent SDK, DeepAgents, AutoGen, LlamaIndex, Pydantic AI, Google ADK, CrewAI or OpenAI Agents SDK, and any Python function. Another framework needs one adapter class, and assistants connect through MCP. The only change Brevet makes to the agent is to route its declared tools through its tool broker.
In a folder beside the agent, readable only by you and kept out of version control. Each entry is appended and linked to the one before it, so brevet verify detects an edited history. You can anchor the latest entry outside that folder and mirror every entry to a CHAP coordinator.
Yes, through the MCP server. Brevet checks the rules it serves the assistant, and in Claude Code a hook holds each tool call to the tiers the release grants. Name Claude’s skill folders and instruction files in the manifest, and a change to them is flagged until it is released. Where the vendor runs the assistant’s own memory, Brevet cannot stop that memory changing.
CHAP records what happened between people and agents. Metis helps capture fragments of tacit expertise: what an expert notices, how they respond and the circumstances. The expert confirms the account, and reviewers agree when an agent may use it as guidance. Brevet governs how the agent changes, and on whose approval. They are designed to work together, and each works on its own.
Brevet is in alpha. Today it provides the loop, the record and the controls a production deployment switches on: verified approvers, releases tied to their test runs, rollback, recall confirmations, a tool broker and an anchored record. Your deployment names the approvers and the source that vouches for their keys, chooses where the anchors live, supplies independent tests and routes every run through Brevet. Who does what, under For builders, sets this out.
Exploring the research
Start with a workflow where people and agents work together. Identify the agents involved, the teams responsible and the evidence they would need to approve a change. Try Brevet with one of those agents before extending its use.
Brevet · by Brightbeam
Bring a workflow where people and agents work together. We can examine how changes are approved today, what evidence reviewers need and how a change could be withdrawn.