IT-RAT agent governance/the stack Live demo Guides Proof Console
IT-RAT · cloud security · IAM · FinOps

Run AI agents like a workforce, not a wildfire.

A new hire gets a contract, a budget, a badge and a manager. An AI agent usually gets an admin key and a prayer. We build the open-source governance that closes that gap: services that meter, police, remember, identify, audit and rehearse your agents at runtime.

Enter the stack → The stack in depth GitHub ↗
proof, not promises

Validated on real infrastructure. Then torn down.

Before this site existed, the stack ran on disposable boxes across Hetzner, AWS and GCP with a real Anthropic key. Then the same stack came up again as a five-node Kubernetes cluster on each of those three clouds.

8000/8000
Money, under load. Requests admitted against one budget, on a stub provider.
$0.00042
Money, per unit of work. The measured cost of one correctly resolved case.
2,449/s
Policy, throughput. Decisions a single pod makes each second.
34
Policy, under concurrency. Requests fired at once and sorted exactly right.
426B
Evidence, per decision. Hash-linked audit written for every decision rather than a sample.
12/12
Portability. Deliberate budget overruns blocked, identically on Hetzner, AWS and GCP.
25,586
Crypto inventory. Real Linux binaries scanned by Qryx, with zero crashes.
0
Rehearsal. Guardrail gaps across three hostile drills fired twice at a real gateway.
What is proven, claim by claim → How these numbers were produced
the stack

One corridor, every door on it.

Every service has its own room: what it does, how it behaves over a live time window, and where it sits in the wiring. Every room is Apache-2.0, with nothing behind a licence. Genaryx, first on the rail, is the control room, and it runs on your own infrastructure like the rest.

scroll sideways, or drag
how it wires

One passport, one event bus, four planes of control.

Every request carries an Agent Passport. An agent has two ways out, not one: a call to a model, and a fetch of something on the internet, and each has a gate standing in it. Below, memory, identity, crypto, quality, rehearsal and alerting read the same NDJSON stream off-path. Nothing here is a dashboard after the fact: the gates enforce in-line, in seconds.

Vouchryx mints · revokes · jwks Wardryx allow · deny · hold agent carries a passport two ways out TokenFuse budgets · breaker · router 402 when the money stops model provider Anthropic · OpenAI · local Scopyx scheme · host · addresses policy, then robots.txt the web any host, every redirect agent-event bus · NDJSON · taipanbox.dev/agent-event /v1/decide /v1/token polled, not per call Engram Idryx Qryx Verdryx Mockryx Heraldyx
money
Per-run budgets, loop detection, burn forecast, a breaker that answers 402 in seconds.
policy
Deterministic allow, deny or hold-for-a-human. No model in the decision path.
knowledge
Memory with provenance: what the agent knew, when it knew it, and why.
trust
Identity, crypto posture, quality drift and pre-prod drills over the same events.

New to this? The guides are grouped by what you came for: where to start, how the stack is secured, the practice of running agents, from governance to FinOps for AI, each service in depth, and what changed in October. Every room above links its own guide, and the stack in depth holds the rest of this page.

“Your AI agents are employees. You just forgot to onboard them.” Tania Fedirko, FinOps Expert, on why this stack exists
why all of it is open

Governance you cannot read is governance you have to trust.

Every part of this stack is Apache-2.0, the console included, and that is not a marketing posture. These services decide what an AI agent may do: what it may spend, which tools it may call, whose authority it acts under, and what evidence exists afterwards. A control whose entire job is to remove the need for trust cannot itself be a thing you take on trust.

The longer answer →
the people

Two of us, plus the agents.

This stack is written by two people who spend their working lives in exactly the two rooms it lives in: cloud security and cloud money.

Yurii Kostiuk
author · cloud security & IAM

Yurii Kostiuk

Lead Security Architect · ex AWS Community Builder

IAM solutions architect and cloud security consultant: Zero Trust, identity, DevSecOps and platform resilience across AWS and GCP. The stack's view that an agent deserves a badge, a budget and a boundary comes straight from this desk.

IAMZero TrustCloud SecurityData SecurityCryptographyAWS / GCPKubernetesGo
CISSP · CCSP · TOGAF 9 · CKA / CKS · AWS SA Professional · Google Professional Cloud Architect
inConnect on LinkedIn
Tania Fedirko
author · finops & cost governance

Tania Fedirko

FinOps Expert · AWS Community Builder

Cloud financial governance, cost optimization and multi-cloud strategy. Tania aligns engineering, finance and business, and applies FinOps practice to LLM APIs and token-based usage: the reason this stack meters money before it meters anything else.

FinOpsFinOps for AICost governanceMulti-cloudGreenOps
FinOps Certified Professional · FinOps Certified Practitioner
inConnect on LinkedIn
common questions

The questions that come before the demo

What is AI agent governance?

Governance is the set of controls that decide what an agent is allowed to do while it is running: a budget it cannot exceed, a policy it must ask before acting, an identity that records who it acts for, a memory that can say where a belief came from, and evidence an auditor can verify afterwards.

Is the stack open source?

Yes, all of it. Apache-2.0, source on GitHub: TokenFuse, CostCrew, TokenFuse Pocket, Wardryx, Idryx, Scopyx, Vouchryx, Qryx, Verdryx, Typryx, Mockryx, Trailryx, Heraldyx and Engram, the shared contract under them, and Genaryx, the console over all of them.

Do you host any of this, or see our data?

No. Every plane runs on infrastructure you own: AWS, GCP, Hetzner, any cloud or on-prem, and on-prem is measured rather than merely allowed: on 2026-09-17 the whole stack ran on a small box behind a home router, governing agents in AWS and GCP at the same time. We never run your control plane, hold your keys or store your traffic, so there is nothing on our side to subpoena or breach.

What does it cost to try?

Nothing, and no account. Every part of it is Apache-2.0, the console included. One command builds and starts the long-running services locally: see run the live stack locally. The four that are libraries and CLIs each carry a one-line try-it on their own page.