Kelhe client

Configure the client once, then pass it to guard(). It holds only stable settings — no per-call data.

from kelhe import Kelhe, Mode

kelhe = Kelhe(
    api_key="sk_kelhe_...",     # or set KELHE_API_KEY
    mode=Mode.ENFORCE,          # OBSERVE (default) or ENFORCE
    risk_threshold=7.0,         # score >= this is "risky"
)

Options

Argument	Default	Purpose
api_key	KELHE_API_KEY env	Your key (sk_kelhe_...). Required.
mode	Mode.OBSERVE	OBSERVE scores and logs only; ENFORCE blocks risky actions.
risk_threshold	7.0	An action scoring ≥ this is risky.
on_api_error	FAIL_CLOSED	What to do if scoring fails — see Errors.
base_url	https://api.kelhe.com	Override for VPC / self-hosted (or KELHE_BASE_URL).
timeout	3.0	Scoring request timeout, in seconds.
audit_handler	None	Called for every action, both modes. See Modes.
escalation_handler	None	Called for a risky action in Enforce; return True to allow.

Environment variables

• KELHE_API_KEY — used when api_key is not passed.
• KELHE_BASE_URL — used when base_url is not passed (enterprise / VPC).

Outcome

Guarding an action produces an Outcome: the captured action, the result (score, confidence), risky (score ≥ threshold), enforced (blocked — risky and Enforce mode), and a human-readable reason. Your audit_handler and escalation_handler receive it.