Quickstart
Get your agent governed in under five minutes.
1. Install Transient Trace
pipx install transient-tracepipx installs into an isolated environment and puts transient-trace on PATH permanently. If you don't have pipx: brew install pipx && pipx ensurepath.
2. Set up governance shims
Shims intercept binaries at the OS level. Every call to git, curl, npm etc. from any agent, script, or tool on the machine goes through governance first.
transient-trace wrap install git curl npm pip3 uv sudo --auto-rc
source ~/.zshrcVerify everything is wired up:
transient-trace wrap status
which git # should return ~/.transient-trace/shims/git3. Boot your agent through Transient
Transient requires you to launch your agent through it. You do not run your agent directly — you run it via transient-trace run. This is how the governance layer wraps the process.
transient-trace run python agent.py
transient-trace run claudeEvery session must be started this way. Launching an agent directly without transient-trace run means there is no session context, no linked receipt chain, and no popen hook. Permanent shims will still intercept specific binaries but the receipts are unconnected.
For full governance, always start through transient-trace run.
That's it. Every action the agent takes is now intercepted, evaluated, and receipted.
4. Add OWASP governance packages
Packages are curated rule sets aligned to the OWASP Agentic Security Initiative. Load them to enforce specific security boundaries:
transient-trace --mode strict --packages filesystem,code,privilege,shell run python agent.py| Package | Blocks |
|---|---|
| filesystem | Bulk delete, sensitive paths (~/.ssh, /etc) |
| code | git push to remote, package installs without lockfile |
| privilege | sudo, su, chmod escalation, user management |
| shell | curl | bash, eval, inline code execution |
| web | SSRF, mutation requests to internal hosts |
| messaging | External email, broadcast to unknown recipients |
5. View receipts
Every governed action produces a tamper-evident receipt:
transient-trace receipts summary
transient-trace receipts list
transient-trace receipts list --outcome denyGovernance modes
| Mode | Behaviour |
|---|---|
| audit | Record everything. Never block. Default. |
| strict | Block on policy violations before execution. |
| permissive | Log violations. Never block. |
Set strict as the permanent default:
transient-trace config set mode strictDashboard (TUI)
Use the terminal dashboard for live receipts, runtime config updates, and permission/rule changes while agents are active.
transient-trace dashboardConnect Recall and Intelligence (in development)
Recall and Intelligence integration is currently in development. When available, start the receipt bus to connect them to Trace automatically:
cp transient.config.example.json transient.config.json
# Edit transient.config.json with your Recall and Intelligence endpoints
npm install
npm startThe receipt bus polls Trace receipts every 30 seconds and dispatches events to Recall and Intelligence. No agent code changes required.