LIVE DEMO. FOUR GOVERNANCE LAYERS, REAL TIME, SIX MINUTES.
A recorded walkthrough of the same binary you deploy, showing four governance layers executing in real time on a Claude agent in six minutes.
Zero-Install Audit Preview
A CTO evaluating governance infrastructure wants to see it run before committing an engineer to an evaluation. The video below is a recorded session of the production binary, not a mock and not a marketing animation. Six minutes is how long a cold start takes from first boot to the first denied tool call. Anything shorter would skip the boot sequence a security reviewer cares about.
There is nothing to install to watch. A CISO can forward the link to their audit team without handing out credentials or asking anyone to clone a repository. The reviewer sees what an operator will see on day one. Same enforcement layers, same audit rows, same binary you own after deployment.
Four-Layer Enforcement On Camera
A demo that only shows the happy path proves nothing. In the walkthrough, an admin-scope agent calls an MCP tool and the call is permitted. A user-scope agent calls the same tool and the request is refused before any handler runs. The denial is not a dashboard after the fact. It is the request-path gate refusing to dispatch, so an auditor watching the video can see the decision made in-process rather than logged after a breach.
The governance pass the agent walks through is the same one documented on the governance-pipeline feature page. A permission check compares the caller to the tool. A credential scan inspects the tool inputs for AWS keys, GitHub tokens, PEM private keys, and API secrets, so a prompt injection that tries to exfiltrate a key into an outbound request never leaves the box. A per-caller rate check refuses bursts sized to catch runaway agent loops without throttling normal work. Every outcome, allow or deny, writes one row to the audit table the demo queries live at the end.
The walkthrough includes the query. A CISO asking "can I prove this in an audit?" sees the answer on screen. A SQL query over the audit table returns the allow and deny rows with agent identity, tool name, reason, and timestamp, in the same shape a SIEM would ingest.
- Tool gating blocks privilege bleed — A user-scope agent asking for an admin tool is refused before the handler runs. The demo shows the same tool name permitted for admin and denied for user, so the gate is visibly at the request path, not in review.
- Secret scan blocks exfiltration via tool input — A prompt-injected AWS key pasted into a tool argument is caught and the call is refused. Protects against the leak path where a credential enters the model context and is smuggled out through an outbound tool call.
- Audit row per decision, queried on video — Every allow and every deny writes one row with agent identity, tool name, reason, and timestamp. The walkthrough ends with a live SQL query over that table, which is the exact surface an auditor reviews after a security incident.
- Cost attribution survives scope changes — Every request carries its agent identity through the audit write, so a finance team asking which team spent this month gets one grouped query instead of a regex across logs.
- hooks.rs (HookEvent enum) HookEvent variants fired as the agent runs in the walkthrough.
- rbac.rs (request-path gate) Permission check runs before dispatch. Both allow and deny flow through it.
- scanner.rs (scanner detection) Rejects probe paths, scanner agents, and high-velocity traffic before handlers run.
Binary Parity, Laptop to Prod
A staff engineer watching the demo asks two questions. Can I reproduce this on my laptop without a cloud account, and is the binary in the video the binary I deploy? Both answers are yes. The walkthrough runs the same compiled artifact that ships to production, with no demo-mode flag, no feature gate, and no hosted control plane holding the governance rules somewhere else.
Horizontal scale comes from the fact that authentication is a signed JWT read on every request, so a replica added behind a load balancer inherits the governance rules without a session store, a sticky balancer, or a shared cache. A CTO asking whether this replaces what their platform team is currently sketching gets the build-vs-buy answer here. One process owns identity, policy, audit, and MCP lifecycle, so the alternative is four services to ship and upgrade.
Self-hosted means self-controlled. The binary runs inside your perimeter. Air-gap deployment is supported because there is no phone-home and no outbound dependency beyond the database. An auditor running a network egress check against the running process sees nothing leaving the box. The audit rows, the governance decisions, and the secrets resolution all stay in your environment.
- Same binary you watch, same binary you deploy — No demo mode, no feature flags, no hosted control plane. The artifact on the video is the artifact a release engineer signs and ships, so a security review of the demo is a security review of production.
- Air-gap capable, no outbound calls — Runs behind your firewall with zero phone-home. The reviewer can verify on the walkthrough host that outbound traffic during agent execution is limited to the databases and APIs the tools explicitly call.
- Reproducible in under thirty minutes — Clone the template repository, build the binary, point at a local PostgreSQL. A staff engineer who wants to verify the demo on their laptop is serving their first governed request in under thirty minutes, because the only external dependency is the database.
Founder-led. Self-service first.
No sales team. No demo theatre. The template is free to evaluate — if it solves your problem, we talk.
Who we are
One founder, one binary, full IP ownership. Every line of Rust, every governance rule, every MCP integration — written in-house. Two years of building AI governance infrastructure from first principles. No venture capital dictating roadmap. No advisory board approving features.
How to engage
Evaluate
Clone the template from GitHub. Run it locally with Docker or compile from source. Full governance pipeline.
Talk
Once you have seen the governance pipeline running, book a meeting to discuss your specific requirements — technical implementation, enterprise licensing, or custom integrations.
Deploy
The binary and extension code run on your infrastructure. Perpetual licence, source-available under BSL-1.1, with support and update agreements tailored to your compliance requirements.
Want to reproduce this on your laptop?
Clone the template, point it at PostgreSQL, and watch the same governance events on your own machine in under thirty minutes.