systemprompt

Five properties, each one demonstrable on your laptop before any procurement call.

- A single query answers every AI audit.Every request, scope decision, tool call, model output, and cost lands in one 18-column Postgres table. Six correlation columns (UserId, SessionId, TaskId, TraceId, ContextId, ClientId) bind identity at construction time, so a row without a trace is a programming error.
- Credentials physically cannot enter the context window.The governance process is the parent of every MCP tool subprocess. Keys are decrypted from a ChaCha20-Poly1305 store and injected into the child's environment byCommand::spawn(). The parent, which owns the LLM context, never writes the value. 35+ regex patterns deny any tool call that tries to pass a secret through arguments.
- Self-hosted, air-gap capable, single artifact.One Rust binary. One PostgreSQL. No Redis, no Kafka, no Kubernetes, no SaaS handoff. The same binary runs on a laptop, a VM, and an air-gapped appliance without modification. Zero outbound telemetry by default.
- Policy-as-code on PreToolUse hooks.Destructive operations, blocklists, department scoping, six-tier RBAC (Admin, User, Service, A2A, MCP, Anonymous). Rate limiting at 300 req/min per session with role multipliers. Every deny reason is structured and auditable.
- Certifications-ready, not certification-marketing.Tiered log retention from debug (1 day) through error (90 days). 10 identity lifecycle event variants. SIEM-ready JSON events for Splunk, ELK, Datadog, Sumo. Built forSOC 2 Type II,ISO 27001,HIPAA, and theOWASP Agentic Top 10.

Every claim in this README has a script that executes it against the live binary.

./demo/00-preflight.sh # acquire token, verify services, create admin ./demo/01-seed-data.sh # populate analytics + trace data # Governance: the audit line ./demo/governance/01-happy-path.sh # allowed tool call, full trace chain ./demo/governance/05-governance-denied.sh # scope check rejects out-of-role call ./demo/governance/06-secret-breach.sh # secret-detection blocks exfiltration ./demo/governance/07-rate-limiting.sh # 300 req/min per session enforced ./demo/governance/08-hooks.sh # PreToolUse policy-as-code # Observability: the audit table ./demo/analytics/01-overview.sh # conversations, costs, anomalies ./demo/infrastructure/04-logs.sh # structured JSON events, SIEM-ready # Scale: the overhead budget ./demo/performance/02-load-test.sh # 3,308 req/s burst, p99 22.7 ms

Every tool call passes a chain of in-process checks, synchronously, in under 5 ms. The chain is extensible; these ship built in. Every decision lands in an 18-column audit row.

LLM Agent │ ▼ Governance pipeline (in-process, synchronous, <5 ms p99) │ ├─ 1. JWT validation (HS256, verified locally, offline-capable) ├─ 2. RBAC scope check (Admin · User · Service · A2A · MCP · Anonymous) ├─ 3. Secret detection (35+ regex: API keys, PATs, PEM, AWS prefixes) ├─ 4. Blocklist (destructive operation categories) └─ 5. Rate limiting (300 req/min per session, role multipliers) │ ▼ ALLOW or DENY → 18-column audit row, always │ ▼ (ALLOW) spawn_server() │ ├─ decrypt secrets from ChaCha20-Poly1305 store └─ inject into subprocess env vars only (never parent) │ ▼ MCP tool process credentials live here, never in the LLM context path

Not a policy that asks agents nicely. A process boundary: the parent that owns the LLM context never writes the credential value.

let secrets = SecretsBootstrap::get()?; let mut child_command = Command::new(&binary_path); // Child env only. The parent (LLM context path) never touches the value. if let Some(key) = &secrets.anthropic { child_command.env("ANTHROPIC_API_KEY", key); } if let Some(key) = &secrets.github { child_command.env("GITHUB_TOKEN", key); } // Detach; parent forgets the child after spawn. let child = child_command.spawn()?; std::mem::forget(child);

Before spawn, secret detection scans tool arguments for 35+ credential patterns. A tool call that tries to pass a secret through the context window is blocked even if the agent has scope to run the tool. The hero recording above is the scripted proof:./demo/governance/06-secret-breach.sh.

Governance that adds more than 1% latency gets bypassed. This one doesn't. Each request performs JWT validation, scope resolution, three rule evaluations, and an async audit write.

Reproduce:just benchmark. Numbers measured on the author's laptop.

MCP governance, analytics, closed-loop agents, compliance.

Integrations: any provider, web publisher, extensions.

3,308 req/s burst, p99 22.7 ms ·just benchmark

Claude for Work ships with extension points for inference, identity, and audit. Point them at this binary and every prompt, tool call, and cost line lands in a Postgres row you own.

Developer Machine Enterprise Gateway Upstream Inference (Pi, Claude Code, curl) (this binary, your VPC) (pluggable) ───────────────── ──────────▶ ───────────────────── ──────▶ ───────────────── Access token /v1/messages Anthropic direct Managed MCP list Governance pipeline Bedrock / Vertex Signed plugins Audit to Postgres OpenAI / Groq On-prem vLLM / Qwen Air-gap capable

The same governance pipeline described above enforces scope, secrets, policy, and quota before a byte leaves your network, in-process against a cached entitlement table: p9922.7 ms, <1% of AI response time.

POST /v1/messagesat the Anthropic wire format. Every inference request flows through the same governance pipeline as every tool call. A route maps a requested model pattern to a provider you declared: