Architecture

Control plane meets data plane

ActantOS separates policy definition, identity, approvals, and evidence storage from the proxy gateway and isolated executors that enforce decisions in real time.

MVP pipeline

Enforcement decision flow

Pi / MCP Client
      |
      v
ActantOS Adapter / MCP Gateway
      |
      +-- normalize tool call
      +-- canonicalize path / URL / command
      +-- attach agent + user + session identity
      +-- compute risk class
      v
POST /v1/intercept/tool-call
      |
      +-- kill switch check       -> deny if active
      +-- budget/rate-limit check -> deny if exceeded
      +-- Cedar PDP evaluation    -> permit / forbid
      +-- risk classifier         -> approval_required / none
      +-- approval state check    -> valid / missing / expired
      v
Decision: allow / deny / approval_required
      |
      +-- allow             -> Docker sandbox executor
      +-- approval_required -> manual approval API
      +-- deny              -> fail-closed, log reason
      v
POST /v1/tool-result
      |
      v
Postgres Audit Log (hash-chain)

Enterprise

Phase 3 target

Hosted Control Plane (Phase 3)
  OIDC / SCIM | SIEM Export | WORM Audit Store
  Credential Broker | Policy Marketplace | Advanced Approvals
        |
        v
Hardened Data Plane
  +-- gVisor  (single-tenant hosted)
  +-- Firecracker microVMs (multi-tenant SaaS)

Principles

Design foundations

Fail-closed by design

If actantosd or the policy engine is unreachable, adapters hard-fail. No tool call executes without an explicit allow decision.

Out-of-process isolation

Policy runs outside the agent memory space. Prompt injection cannot modify runtime security rules.

Deterministic policy

Authorization uses labels, budget state, approval state, and resource metadata — not LLM judgment.

Immutable evidence

Audit events form a hash chain. Enterprise deployments add S3 Object Lock WORM export for compliance evidence.

Quickstart API reference