TL-Agent is a Rust SDK for governing AI-agent actions with independently issued, offline-verifiable receipts. An agent acts only with a valid authorization receipt; completed actions produce portable provenance receipts. Fail-closed by design: no valid receipt, no action.