• Docker, kind, kubectl, and Go ≥ 1.21 on your PATH (kind v0.31–v0.32 tested). Any modern Go works — the build pins its own exact toolchain. Missing something? make quickstart names it and shows the install command.
• Internet egress from the cluster — the sample agents fetch example.com.
• ~5 minutes on a first run — the images are always built from your checkout, never pulled, so what runs is exactly what you cloned. Repeats are faster.

git clone https://github.com/grantbarry29/scrutineer.git
cd scrutineer
make quickstart

Creates a scrutineer-quickstart kind cluster, installs Scrutineer, then runs a canary probe to prove the CNI actually enforces NetworkPolicy. It ends with the verdict:

>> routing-lock enforcement VERIFIED on this cluster (enforced sessions will run).

Your CNI doesn’t enforce NetworkPolicy, so Scrutineer refuses to claim enforcement rather than pretend. Retry on Calico:

make quickstart-down
make quickstart QUICKSTART_CNI=calico

A quickstart cluster that ended VERIFIED, with internet egress (the demo fetches example.com).

make demo

Applies one hardened RuntimeProfile, two AgentPolicy objects differing only in mode, and two sessions running the same busybox agent — nothing in the image cooperates with enforcement. Each agent probes three paths and prints what it experienced (~2 minutes):

Notice: the proxy env is a convenience, not the control — the default-deny NetworkPolicy is why the bypass dies. And it dies in both modes: audit-only relaxes blocking, never the routing lock, or the observations couldn’t be trusted.

make demo ends by printing status.policyDecisions for both sessions.

• action — deny (enforced) vs dry-run (audit) for example.net. Mode changed what happened, never what was seen.
• assurance — every entry is observed: reported by the proxy pod under its own identity. The agent has no path to inject or launder evidence. (Why.)
• what’s absent — the bypass attempt left no entry. The CNI drops it silently; recording attempts unforgeably is a tracked roadmap item, stated rather than hidden.

Dig further:

kubectl get agentsession demo-enforced -o yaml
kubectl get events --field-selector involvedObject.name=demo-enforced
kubectl get pods -l scrutineer.sh/session

• External TLS is tunneled: filtering is by domain, not request bodies.
• Tool and file governance have no enforcement backend yet — removed rather than shipped as advisory; they return as out-of-pod chokepoints.
• The guarantee assumes an enforcing CNI (proved by the gate) and an uncompromised node — spelled out in the design docs.

• A cluster and kubectl.
• A CNI that enforces egress NetworkPolicy (Calico, Cilium, and kind’s default all do). Unsure? Scrutineer checks for you — step 2.
• Nodes that can pull from ghcr.io and Docker Hub.
• Internet egress from pods — the audit-mode run in step 7 really fetches example.com.

No cert-manager, no webhooks — the install is just CRDs, RBAC, and one controller.

git clone --depth 1 --branch v0.2.0 https://github.com/grantbarry29/scrutineer.git
cd scrutineer
kubectl apply -k config/crd
kubectl apply -k config/default
kubectl -n scrutineer-system rollout status deployment/scrutineer-controller-manager

Want to inspect before applying? kubectl kustomize config/default | less.

Scrutineer tests your CNI with canary pods instead of trusting it:

kubectl -n scrutineer-system logs deployment/scrutineer-controller-manager \
  | grep 'lock probe verdict' | tail -1

Verified — enforcement is real. Refused — your CNI ignores NetworkPolicy, so Scrutineer will only run audit-only sessions rather than fake enforcement.

How governed agents run. The envoy entry gives each session its own proxy pod and locks the agent’s network to it:

# runtimeprofile.yaml
apiVersion: scrutineer.sh/v1alpha1
kind: RuntimeProfile
metadata:
  name: enforced-egress
  namespace: default
spec:
  container:
    runAsNonRoot: true
    runAsUser: 65532        # busybox runs as root by default; remap it
    runAsGroup: 65532
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]
  pod:
    seccompProfile:
      type: RuntimeDefault
  enforcement:
  - name: envoy
    type: envoy
    enabled: true

kubectl apply -f runtimeprofile.yaml

Deny one domain, enforced:

# policy.yaml
apiVersion: scrutineer.sh/v1alpha1
kind: AgentPolicy
metadata:
  name: deny-example
  namespace: default
spec:
  mode: enforced
  deniedDomains:
  - example.com

kubectl apply -f policy.yaml

The agent is plain busybox — it doesn’t know Scrutineer exists. It tries the denied domain:

# session.yaml
apiVersion: scrutineer.sh/v1alpha1
kind: AgentSession
metadata:
  name: first-session
  namespace: default
spec:
  task:
    description: Try one denied egress and exit
    prompt: noop
  model:
    provider: openai
    name: gpt-4.1
  runtime:
    orchestrator: kubernetes-job
    image: busybox:latest
    command:
    - sh
    - -c
    - |
      wget -q -O /dev/null http://example.com/ \
        && echo "egress succeeded" \
        || echo "egress blocked"
      exit 0
  runtimeProfileRef:
    name: enforced-egress
  policyRefs:
  - kind: AgentPolicy
    name: deny-example

kubectl apply -f session.yaml
kubectl get agentsessions -w        # Pending → Running → Succeeded

While it runs, kubectl get pods,networkpolicies shows the agent pod, the first-session-egress proxy pod, and two NetworkPolicies: the routing lock on the agent, a backstop on the proxy.

kubectl get agentsession first-session -o jsonpath='{.status.policyDecisions}' \
  | jq '.[] | select(.phase=="runtime")'

{
  "type": "network",
  "target": "example.com",
  "action": "deny",
  "assuranceLevel": "observed",
  ...
}

(The reporter batches; if the output is empty, wait a moment and re-run. The select skips merge-phase entries — control-plane records of how your policies were resolved — and keeps what the proxy observed.)

observed = reported by the proxy under its own identity. The agent can’t forge or suppress it; anything the agent submits is stamped self-reported instead. (Why.)

The block itself, at the proxy:

kubectl logs first-session-egress -c envoy | grep example.com   # → 403

One field turns enforcement into rehearsal — traffic flows, the denial is recorded as dry-run. Flip the policy, then run a second session under it:

kubectl patch agentpolicy deny-example --type merge -p '{"spec":{"mode":"audit-only"}}'
sed 's/name: first-session/name: first-session-audit/' session.yaml > session-audit.yaml
kubectl apply -f session-audit.yaml
kubectl get agentsessions -w

Same agent, same rule: this time the wget goes through. Read the new record:

kubectl get agentsession first-session-audit -o jsonpath='{.status.policyDecisions}' \
  | jq '.[] | select(.phase=="runtime")'

"action": "dry-run" — still observed. And first-session still holds its deny: re-run step 6 and compare them side by side. Mode changed what happened, never what was seen.

A second session — not a delete-and-rerun — on purpose: the session object is the audit record, and today the evidence lives only in its status. Delete the session and the record is gone. Rerun by creating a new session; keep the old one.

kubectl delete -f session.yaml -f session-audit.yaml -f policy.yaml -f runtimeprofile.yaml
kubectl delete -k config/default

(config/default includes the CRDs, so the second command removes everything — including any sessions still on the cluster, and their evidence with them.)