Agentic Security
Built on Lodestar OSSv0.3.0 · LiveYour team governs your agent fleet.
Approve, audit, and prove what your AI agents actually do. Machinaut is the hosted, multi-tenant trust layer on top of Lodestar OSS — now live as the v0.3.0 governance console, not another observability dashboard.
Lodestar OSS already lets you see one agent's reasoning chain, locally. Machinaut is how a team governs a fleet: multi-tenant, actionable, shareable.
v0.3.0 is live and in active development. The explorer and platform are shipped; the governance console — approvals, audit, calibration, team — is in beta, as are the v0.3.0 enterprise surfaces: SSO, SCIM, verified domains, and the Fleet health map. SAML, managed key custody, one-click local signing, and the CLI are planned. Every capability carries an honest status — see the roadmap.
$ lodestar ship sess_8f21c4
✓ shipped 142 envelopes → console.machinaut.ai
hold opened — L4 · push to main
approver opens why-chain — observations → beliefs → decision
signed decision — verified customer-side
→ action proceeds
The category
A trust layer, not a dashboard.
Machinaut is Agentic Security: governing what an agent does and proving why — the epistemic chain from observation to decision. That is a different job from the tools it's often confused with.
Not "see your agent's chain"
Lodestar OSS already renders one operator's reasoning chain, locally and read-only. We don't resell that.
Not observability
Langfuse, LangSmith, and Phoenix watch tokens and traces. Machinaut governs what an agent does — and proves why.
Not model-boundary security
Jailbreak and prompt-injection defense guard the model input. Machinaut guards the agent's actions and the epistemic chain behind them.
“Your team governs your agent fleet: approve, audit, prove.”
The product · v0.3.0
The governance console is live.
Ship a session from your environment and your whole team gets the same hosted surface: the reasoning chain, held actions to approve, an org-wide audit trail, calibration across the fleet, and roles. v0.3.0 adds the Fleet health map and enterprise identity. Below are real captures of the shipped console — each surface carries the same honest status it shows in its own UI.
Chain explorer + trust report
The six-stage chain — observations → claims → evidence → beliefs → decisions → actions — beside the Lodestar trust report. The projection is Lodestar OSS; Machinaut hosts it, indexes it across the fleet, and makes it shareable. This is the prove story.
Approval inbox
A held L4 action and the why-chain behind it — approve or deny, Ed25519-signed and verified customer-side. The approve story.
Console overview
The fleet at a glance: sessions, held-action rate, calibration health, and sentinel alerts across every project and teammate.
Audit log
Every governance decision — approve, deny, run, block — with the proof your agent already produced, exportable to CSV / NDJSON. The audit story.
Calibration
Per-session ECE / Brier and which confidence classes are miscalibrated. The calibration math is Lodestar OSS; the console organises it across runs.
Fleet — the multi-org health map
Every agent you govern, across every org, worst-first. Fleet adds no reach beyond membership — it unifies exactly what you could already see one org at a time. Note what it doesn't claim: spend and drift are labelled planned in the product itself, because no usage metering or drift baseline exists yet. New in v0.3.0, on Team and Enterprise.
Team & roles
Owner / member RBAC and email-bound invites — the multi-operator layer the single-operator OSS viewer structurally isn't. (No email is sent yet; you copy a signed invite link — we'd rather say so than fake it.)
Enterprise identity
BetaAlso new in v0.3.0, and live on the hosted console: OIDC single sign-on with just-in-time provisioning and IdP group → role mapping, enforce-SSO with audited break-glass owners, SCIM 2.0 provisioning — where deprovisioning a leaver kills their console sessions and personal API tokens with them — and verified domains with optional auto-join on a teammate's first SSO sign-in.
The boundary holds: SSO governs who may sign in, never who may sign. An SSO-granted owner is console authority, not signing authority — approver keys stay customer-held, so no identity provider, and no compromise of ours, can forge an approval. SAML and managed key custody are planned, not built.
Single sign-on (OIDC)
Point Machinaut at your IdP: the redirect URI to register, JIT provisioning, and IdP group → role mapping. The client secret is sealed at rest (AES-256-GCM). Note the key-custody panel at the bottom — customer-held is live at every tier; managed is planned and refused. New in v0.3.0.
SCIM 2.0 provisioning
Your identity provider keeps the roster in sync. Deprovisioning a leaver kills their console sessions and personal API tokens — but never a customer-held approver key. The SCIM bearer is stored only as a hash. Minting one needs a live SSO connection first, as the screen says.
Real captures of the shipped console against a seed-demo tenant — no customer data. The core explorer is shipped; the governance console and the v0.3.0 enterprise surfaces are in beta. See the full status on the roadmap.
The spine — non-negotiable invariant
Machinaut never hosts the agent runtime.
The write side and the approver keys stay in your environment. Machinaut cloud is the read-side and the approval relay, fed by envelope ingest — the transport, never the signing authority. A shared hosted runtime would fight Lodestar's process-local design, so we don't host the writer; we ingest copies of its output.
Customer environment
Data plane · OSS · you run this
- Guard proxy → action-kernel → adapters
- Event-log writer (NDJSON)
- Approver keys (Ed25519)
- Approval file side-channel
Machinaut cloud
Control plane · we run this
- Ingest → tenant store → indexed search
- projectChain · renderReport (read-only)
- Explorer · approval relay · inbox
- Governance · fleet · retention
A cloud compromise cannot forge approvals. Verification happens customer-side, after transport — the channel is pure transport, and the forgery boundary never moves into the cloud.
Open-core boundary
We don't claim open source as our own.
Lodestar OSS ships a lot for free. Machinaut's value is hosting, multi-tenancy, ingestion, indexed search, the approval write-path, and fleet governance — never the things the OSS already does locally.
Lodestar OSS already ships
OSSFree, local, single-operator. We never rebuild or rebrand these.
- Single-operator Governing UI: chain explorer, report, raw events, read-only pending-approvals, SSE tail
- Sensitivity-ceiling redaction; tamper-evident payload hashing
- Policy Kernel: 3-valued gate, trust-ladder, Ed25519 signed approvals
- Postgres firewall backends; OTel export; calibration math (ECE / Brier)
Machinaut owns
MachinautGenuinely needs a hosted, multi-tenant product.
- Identity — org / tenant / roles (owner/member RBAC shipped; OIDC SSO + SCIM in beta)
- Ingestion — getting local NDJSON logs off the box and into a tenant store
- Indexed search across sessions (the viewer brute-scans; dead at scale)
- The approval write-path as a product; cross-session fleet & governance views
The wedge, one line: multi-tenant, multi-user, actionable, shareable — versus OSS's single-operator, loopback, read-only, local.
The magic moment
One loop: hold → ship → approve → prove.
The solo workflow is never gated. Ingest, the explorer, and shareable reports are shipped today; the hosted approval inbox that closes this loop is in beta. Here's the path an action takes.
- 01
A high-risk action holds
Your guarded proxy hits an L4 action — say, a push to main — and the policy kernel opens a hold. The decision stays in your environment.
- 02
announce notifies
A best-effort, ceiling-gated push tells the approver a hold is open. It can never change the outcome — only its visibility.
- 03
The session ships
lodestar ship sends a copy of the session's envelopes to Machinaut — or it's already there from a prior ship. No live tail; freshness is cheap re-ship.
- 04
The approver reads the why
In the hosted explorer they open the chain: observations → beliefs → decision. The full evidence trail, not just the action.
- 05
A signed decision returns
Approve or Deny is Ed25519-signed and fetched back down — then verified customer-side against operator-pinned keys. Machinaut is pure transport.
- 06
The action proceeds
The verified grant releases the hold and the action runs. A held push-to-main, approved from a phone — and the cloud could never have forged it.
Security & trust model
The forgery boundary does not move.
Approvals are Ed25519-signed and verified customer-side, after transport, against operator-pinned keys. A malicious or compromised endpoint can only delay an approval — and a delay resolves to deny. It cannot mint, upgrade, replay, or revive a grant.
Customer-held keys
What ships today, on Free as well as Enterprise: approver keys stay in your environment. Machinaut is pure transport and cannot forge, period — a security story no observability vendor can tell.
Machinaut-managed keys
A convenience tier that does not exist yet — the console surfaces the selector but refuses it, and no tier defaults to managed. If it ships, it ships ring-fenced per-tenant in KMS, always labelled the weaker posture, and never as the enterprise default.
The two custody models differ in exactly one thing: who holds the signing key. Only the first one is real today — every tier is customer-held, so the “cannot forge” guarantee is not tier-scoped, it is the product. The channel credential never reaches the event log, and the endpoint is operator-pinned config — never discovered from agent or log content.
Roadmap
Built in the open about what's built.
v0.3.0 ships the explorer and platform, with the governance console, enterprise identity, and Fleet live in beta. Status reflects reality, not ambition.
Ingest · Explorer · Share
Hosted, multi-tenant explorer over shipped sessions with shareable chain-report links — plus the platform to run it: email + API-token auth, retention & quotas, telemetry, and the Kubernetes deploy.
Approvals · Calibration · SIEM
The differentiator, live in beta: the approval inbox, calibration charts (ECE / Brier), and the sentinel SIEM with Slack/webhook alerting. The upstream OSS approval channel merged, and the loop is integration-tested end-to-end.
Team governance
The governance console: overview, org-scoped audit log, and owner/member team & roles are in beta. Policy drafting and impact-simulation ship as beta API endpoints; only the policies console surface is still planned, along with one-click local signing and the CLI / Desktop.
Enterprise identity
New in v0.3.0, in beta: OIDC SSO with JIT provisioning, enforce-SSO with break-glass, SCIM 2.0 deprovisioning, and verified-domain auto-join. SSO governs who may sign in — never who may sign. SAML is planned.
Fleet health map
New in v0.3.0, in beta: a worst-first health map across every org you govern, on Team and Enterprise. Health today — spend and drift are labelled planned in-product, because they are not built yet.
Govern your fleet before it governs you.
The v0.3.0 governance console is live. Open it to explore your shipped sessions, approve held actions, and prove what your agents did — or run the whole loop yourself today with Lodestar OSS.
Not signing in yet? Get early-access and launch updates:
No spam — updates only. Self-host is unlimited and free, forever; the cloud free tier covers the solo loop.