← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

Audit log for AG2

"AutoGen" today names two incompatible things: Microsoft's autogen-agentchat (a 2024 rewrite with a different, event-based architecture) and AG2, the community-maintained continuation of the original ConversableAgent API, published on PyPI as ag2 and still imported as autogen. The general AutoGen and AG2 guide covers both at a conceptual level; this one is specific to AG2's actual hook surface, because it is unusually good news for auditing.

A hook system built for this

ConversableAgent.register_hook(hookable_method, hook) accepts a plain callable against a fixed set of hook points. Four of them — safeguard_llm_inputs, safeguard_llm_outputs, safeguard_tool_inputs, safeguard_tool_outputs — exist specifically for monitoring agent interactions. The two input hooks run before the real call: generate_oai_reply calls the safeguard_llm_inputs hook before invoking the model client, and if it returns None, AG2 substitutes a synthetic "blocked" reply instead of ever calling the client. generate_tool_calls_reply does the same for safeguard_tool_inputs before execute_function runs, raising immediately if the hook returns None. This is a genuine, synchronous pre-action gate — not a best-effort callback that a framework might swallow.

Wiring in Vetro

vetro-py's AG2 example builds the four hooks against a Run, with no dependency on ag2 itself:

import autogen
from ag2_safeguard_hooks import create_vetro_hooks

agent = autogen.AssistantAgent(name="assistant", llm_config=llm_config)
hooks = create_vetro_hooks(run, model="claude-haiku-4-5")
for hookable_method, hook in hooks.items():
    agent.register_hook(hookable_method=hookable_method, hook=hook)

Internally, a PolicyViolationError raised by run.llm_request() / run.tool_call() is caught and turned into the None return AG2 itself expects — so a policy block stops the call using AG2's own contract, not an exception type it has never seen.

What is blocking vs. recorded

The two output hooks, safeguard_llm_outputs and safeguard_tool_outputs, necessarily run after the response or result already exists — they record it, they cannot undo it. The two input hooks are the real enforcement point, and they are exactly where a destructive tool call (an unbounded shell command, an unapproved write) should be stopped, not merely logged. See human oversight evidence for why that distinction matters to a reviewer.

Check your own logs

Every ledger create_vetro_hooks writes is hash-chained and ed25519-signed, and verifiable with the same JS or Python CLI regardless of which produced it. Paste one, or an OpenTelemetry GenAI trace, into the free checker. For a report to hand to an auditor, Vetro Attest issues a 49 USD counter-signed mapping to EU AI Act articles.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.

Pricing