Browse the source code, open issues, submit pull requests, and star the project.
admina-org/admina βAsk questions, share your setup, propose features, and talk to the maintainer and community.
Join discussions βFound a bug? Have a feature request? Open an issue β we respond as soon as possible.
Open an issue βHow to set up your dev environment, coding conventions, testing, and submitting PRs.
Read CONTRIBUTING.md βHow to contribute
All contributions are welcome, from bug fixes to new governance domains and plugins. Here are the most impactful ways to help.
Report bugs and edge cases
Run Admina in your environment and share what you find. Real-world edge cases improve governance quality for everyone.
Contribute injection patterns
The Agent Security firewall uses a library of regex patterns. Add new patterns for attack vectors you've encountered β each one protects all Admina users.
Write connectors
LangChain, CrewAI, n8n, OpenClaw, and Cheshire Cat connectors ship with every release, alongside seven model-provider adapters and β since v0.11.0 β an OpenAI-compatible governance gateway. New framework integrations are always welcome β see the plugin system's 9 interfaces.
Improve documentation
Clear docs are as important as good code. Fix typos, improve examples, translate content, or write a tutorial.
Share benchmarks
Run the benchmark suite on your hardware and share the results. Performance data from diverse environments strengthens the project.
Star and spread the word
A GitHub star signals to the community that this project matters. Share Admina with your team, write a blog post, or talk about it at a meetup.
Why "Admina"?
Admina comes from admin β administrative oversight, system governance β shaped into a name with a firm, precise sound, like a trusted system daemon always running quietly in the background.
It also echoes admina as in sysadmin β the person who manages, enforces rules, and keeps systems in order. Exactly what Admina does for AI agents.
Stress on the first syllable: Γ-dmi-na. Think of it like Γ dmin + a, not ad-mΓ-na. Three clean syllables, firm and direct β like the governance it provides.
Wondering how Admina compares to Cordum, Guardrails AI, NeMo, Lakera, and other AI-governance frameworks? See the full comparison β
Changelog
Past releases β what shipped, when, and why. The full release history with per-version details is maintained in the source repository, alongside the code it documents.
Roadmap
Where Admina is going next. Pre-1.0: the public API is feature-complete and production-ready, but the stability commitment is deferred until community validation has confirmed the shape of the public surface. Releases ship when scope is ready β not on a calendar. Full forward plan in ROADMAP.md.
- SDK streaming.
GovernedModel.stream()yields PII-redacted deltas as an async iterator; the newStreamRedactorholds back a trailing window (sized by thestream()kwargstream_window_chars, default 64) so an entity split across delta boundaries is still redacted. A blocked prompt yields no deltas and reportsaction="BLOCK"without raising; the full outcome lands inlast_stream_result - Streaming on the adapter contract via
BaseModelAdapter.send_stream()β real incremental streaming for the OpenAI, Ollama, vLLM, and Anthropic adapters; Mistral, Gemini, and Bedrock use the base single-chunk fallback - OpenAI-compatible governance gateway β
POST /v1/chat/completions(streaming and non-streaming) plusGET /v1/models, forwarding to a configurable upstream (ADMINA_GATEWAY_UPSTREAM) while the canonical pipeline runs inline. A blocked request returns a synthetic completion (or SSE stream) withfinish_reason: "content_filter"instead of a raw HTTP error, and every request is written to the forensic log. Protected by the existing credential check - Microsoft Presidio as a selectable PII engine (
ADMINA_PII_ENGINE=presidio, behind the[presidio]extra). Detection only β Admina keeps its own masking, so the output format is identical across engines. The default engine is unchanged (spacy-regex) - Breaking:
/api/v1/validatereturnsaction="REDACT"in place of the former"MODIFY"β a clean rename with no compatibility shim, permitted under the pre-1.0 posture - Signed forensic chain state.
_chain_state.jsoncan be signed with HMAC-SHA256 (ADMINA_FORENSIC_STATE_KEY, signature in a.sigsidecar); a missing or invalid signature is treated as untrusted and the chain is reconstructed from the immutable records - Configurable guard fail mode (
ADMINA_GUARD_FAIL_MODE=open|closed, defaultopen): underclosed, an exception raised inside a governance guard turns into aBLOCK
- Emission of the streaming-request metadata shaped in v0.11.0 onto the OpenTelemetry GenAI semantic conventions (
gen_ai.request.model,gen_ai.usage.*,gen_ai.response.finish_reasons,gen_ai.client.operation.duration) - SLO panel on the Prometheus metrics (the
/metricsendpoint itself already ships) - Structured error taxonomy (stable error codes across proxy, SDK, REST)
- Shared async pool for data connectors; decision cache on the injection firewall fast path
- Benchmark regression gate in CI (fail on a >10% regression versus baseline)
- Request-level tracing correlation SDK β proxy β upstream LLM
- Organisation / workspace isolation in the proxy
- Per-tenant quotas (rate, forensic retention, templates)
- RBAC on proxy endpoints (read / write / admin)
- OIDC auth provider as built-in plugin
- Per-tenant forensic namespace with independent hash chains
- NIS2 template (incident response, supply-chain obligations)
- ISO/IEC 42001 (AI management system controls)
- SOC 2 (Trust Services Criteria mapping)
- Cross-framework gap analysis (single control β multiple frameworks)
- Signed PDF/DOCX report export
- Plugin ABI v1 frozen with contract tests; third-party plugin certification suite
- Official client SDKs: TypeScript, Go
- Deprecation policy formalised; 18-month LTS window for the 1.0 line
- Security advisory process documented; CVE assignment workflow
- Removal of the compatibility shims in
admina/proxy/that keep pre-0.10 imports working