Open source · Apache-2.0 · Runs in your cluster

An agent shouldn’t be able to forge its own audit trail.

Scrutineer is an open-source, Kubernetes-native governance control plane for autonomous AI agents: per-session policy, scoped human approvals, and runtime evidence produced outside the agent’s trust domain. A prompt-injected or compromised agent can’t bypass enforcement or falsify the record of what it did.

The governance layer that wraps whatever you already run.

Get started Read the docs

git clone https://github.com/grantbarry29/scrutineer.git
cd scrutineer
make quickstart

Five minutes to a lock-verified install on a local kind cluster, or install on your existing cluster →

How one governed session runs:

flowchart LR
    subgraph ctrl["Scrutineer controller"]
        recon["session<br/>reconciler"]
        rep["reporter service<br/>TokenReview on every caller"]
    end
    recon -- "provisions per session" --> sess
    subgraph sess["one governed session"]
        subgraph apod["agent pod"]
            agent["agent container<br/>stock image · unprivileged<br/>credential-empty"]
        end
        subgraph ppod["egress proxy pod · own identity"]
            envoy["Envoy"]
            erep["egress-reporter<br/>sidecar"]
        end
    end
    agent -- "the only working path" --> envoy
    agent -. "bypass attempt:<br/>raw socket, direct DNS" .-> lock["dropped in the kernel<br/>default-deny NetworkPolicy"]
    envoy -- "allow / deny by policy" --> up["allowed upstreams"]
    envoy -- "access log<br/>(shared volume, tailed)" --> erep
    erep -- "reports under the<br/>pod's identity" --> rep
    agent -. "agent reports too" .-> rep
    rep -- "assurance stamped<br/>by caller identity" --> ev["evidence in session status<br/>observed vs self-reported"]

Core concepts

Sessions, policies, profiles, the two locks, and evidence assurance.

Quickstart

One command to a running, lock-verified Scrutineer on a local kind cluster, in about five minutes.

Demo: untamperable egress governance

Two sessions, same bring-your-own agent: a live denial, a bypass attempt killed by the routing lock, and evidence the agent couldn’t forge.

Install on your cluster, step by step

Every command visible, on your existing cluster: install, deny one domain, run an agent, read the proof.

FAQ

Why not just a firewall, a service mesh, or a CNI? Honest comparisons and the reasoning behind the enforcement model.