Enterprise Agent Ops

A private, self-hosted AI Agent Operations Platform.

The same autonomous-agent productivity your teams got hooked on — manage projects, build & test code, track attendance, logins/access, and daily reports — but running entirely inside your network, under full governance:

• 🔐 SSO/RBAC — identity + least-privilege access (no unauthenticated tool calls)
• 📜 Immutable audit log — HMAC-chained, tamper-evident record of every action
• 🛑 Human-approval gates — risky actions wait for a real person to sign off
• 🚫 Zero data egress by default — models & tools resolve to in-network endpoints
• 🤖 5 ops agents — attendance, daily reports, access tracking, project ops, build/test

Built to close the shadow-AI security hole: employees want the productivity, IT blocks cloud AI for data-privacy reasons — this gives them the governed middle ground.

---

Quickstart (no external model API needed)

# 1. Demo the full governed-autonomy control loop
python3 scripts/demo.py

# 2. Run the bundled unit tests (audit, rbac, gates)
python3 scripts/validate_pack.py          # or: python3 -m pytest tests/

# 3. Start the governed HTTP API (FastAPI)
pip install -r requirements.txt           # fastapi, uvicorn, pydantic, pyyaml
uvicorn api.main:app --host 0.0.0.0 --port 8080
# GET /health · POST /run · GET /audit · POST /gate/{id}/decide

Prefer containers?

# 4. Docker Compose deployment (core + db + web + worker)
cp .env.example .env   # fill values; defaults = zero-egress
docker compose up -d

---

Structure

Path	Purpose
core/	Orchestration engine: audit, auth/RBAC, gates, tools, task queue
agents/	Ops workflows: attendance, daily report, access tracker, project, build/test
api/main.py	FastAPI governed agent surface
config/	RBAC entitlements + tool registry (risk levels)
security/	Hardening checklist + threat model
compliance/	SOC2 / ISO 27001 / GDPR control mappings
runbook/ADMIN_RUNBOOK.md	Deploy + configure + operate
tests/	audit / rbac / gates unit tests
scripts/	demo + pack validator + bootstrap

Governance model (the heart of it)

Every tool call passes the same control loop in core/task_queue.py:

Authenticate → RBAC scope check → tool allowlist check → risk routing
→ (high-risk ⇒ human-approval gate) → execute → immutable audit append

License

MIT — see LICENSE.md.

Disclaimer

This is a self-hosted software kit, not a certification. The compliance/ matrices are control mappings + evidence templates to support your own SOC 2 / ISO 27001 / GDPR audit — not a readiness claim. Conduct your own audit.