Kubernetes CRDs, API group scrutineer.sh/v1alpha1:

• AgentSession — one governed run: the agent image, the task, references to policy and profile. All runtime evidence lands in its status.
• AgentPolicy — the rules, plus the mode: enforced (violations blocked) or audit-only (recorded as dry-run, nothing blocked).
• RuntimeProfile — how the workload runs: container hardening and which enforcement backends are on.
• ApprovalPolicy / ApprovalRequest — scoped human approvals for actions that need a person in the loop.

The container image is the agent — reasoning loop, model calls, tools. Scrutineer schedules it and governs what it can reach; nothing in the image needs to cooperate. The demo agent is plain busybox.

Enforcement and credentials both live outside the agent’s trust domain:

Routing lock. A default-deny egress NetworkPolicy makes the per-session Envoy proxy the agent’s only network path. The HTTP_PROXY env is a convenience; the kernel-level deny is the control. Raw sockets and direct DNS die at the CNI.

Capability lock. The agent pod is credential-empty. Secrets that authorize governed actions live outside its reach — a compromised agent has nothing to exfiltrate that would let it act ungoverned.

The routing lock is only real if the CNI enforces NetworkPolicy — some don’t. Scrutineer proves it with a canary probe instead of assuming it. Fail the probe and enforced sessions are refused with a loud EgressLockVerified=False condition. Nothing silently degrades to advisory.

Every decision in status.policyDecisions carries a provenance label:

• observed — reported by the egress-reporter in the proxy pod, authenticated as that pod’s own identity (token review + ownership checks).
• self-reported — anything from inside the agent’s trust domain.

The label is derived from the caller’s authenticated identity, never from the payload — a report can claim observed, and the server overwrites the claim with what the caller’s token proves. The doctrine throughout: a control is either untamperable, or it is labeled for what it is.

• Docker, kind, kubectl, and Go ≥ 1.21 on your PATH (kind v0.31–v0.32 tested). Any modern Go works — the build pins its own exact toolchain. Missing something? make quickstart names it and shows the install command.
• Internet egress from the cluster — the sample agents fetch example.com.
• ~5 minutes on a first run — the images are always built from your checkout, never pulled, so what runs is exactly what you cloned. Repeats are faster.

git clone https://github.com/grantbarry29/scrutineer.git
cd scrutineer
make quickstart

Creates a scrutineer-quickstart kind cluster, installs Scrutineer, then runs a canary probe to prove the CNI actually enforces NetworkPolicy. It ends with the verdict:

>> routing-lock enforcement VERIFIED on this cluster (enforced sessions will run).

Your CNI doesn’t enforce NetworkPolicy, so Scrutineer refuses to claim enforcement rather than pretend. Retry on Calico:

make quickstart-down
make quickstart QUICKSTART_CNI=calico

A quickstart cluster that ended VERIFIED, with internet egress (the demo fetches example.com).

make demo

Applies one hardened RuntimeProfile, two AgentPolicy objects differing only in mode, and two sessions running the same busybox agent — nothing in the image cooperates with enforcement. Each agent probes three paths and prints what it experienced (~2 minutes):

Notice: the proxy env is a convenience, not the control — the default-deny NetworkPolicy is why the bypass dies. And it dies in both modes: audit-only relaxes blocking, never the routing lock, or the observations couldn’t be trusted.

make demo ends by printing status.policyDecisions for both sessions.

• action — deny (enforced) vs dry-run (audit) for example.net. Mode changed what happened, never what was seen.
• assurance — every entry is observed: reported by the proxy pod under its own identity. The agent has no path to inject or launder evidence. (Why.)
• what’s absent — the bypass attempt left no entry. The CNI drops it silently; recording attempts unforgeably is a tracked roadmap item, stated rather than hidden.

Dig further:

kubectl get agentsession demo-enforced -o yaml
kubectl get events --field-selector involvedObject.name=demo-enforced
kubectl get pods -l scrutineer.sh/session

• External TLS is tunneled: filtering is by domain, not request bodies.
• Tool and file governance have no enforcement backend yet — removed rather than shipped as advisory; they return as out-of-pod chokepoints.
• The guarantee assumes an enforcing CNI (proved by the gate) and an uncompromised node — spelled out in the design docs.

• A cluster and kubectl.
• A CNI that enforces egress NetworkPolicy (Calico, Cilium, and kind’s default all do). Unsure? Scrutineer checks for you — step 2.
• Nodes that can pull from ghcr.io and Docker Hub.
• Internet egress from pods — the audit-mode run in step 7 really fetches example.com.

No cert-manager, no webhooks — the install is just CRDs, RBAC, and one controller.

git clone --depth 1 --branch v0.2.0 https://github.com/grantbarry29/scrutineer.git
cd scrutineer
kubectl apply -k config/crd
kubectl apply -k config/default
kubectl -n scrutineer-system rollout status deployment/scrutineer-controller-manager

Want to inspect before applying? kubectl kustomize config/default | less.

Scrutineer tests your CNI with canary pods instead of trusting it:

kubectl -n scrutineer-system logs deployment/scrutineer-controller-manager \
  | grep 'lock probe verdict' | tail -1

Verified — enforcement is real. Refused — your CNI ignores NetworkPolicy, so Scrutineer will only run audit-only sessions rather than fake enforcement.

How governed agents run. The envoy entry gives each session its own proxy pod and locks the agent’s network to it:

# runtimeprofile.yaml
apiVersion: scrutineer.sh/v1alpha1
kind: RuntimeProfile
metadata:
  name: enforced-egress
  namespace: default
spec:
  container:
    runAsNonRoot: true
    runAsUser: 65532        # busybox runs as root by default; remap it
    runAsGroup: 65532
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities:
      drop: ["ALL"]
  pod:
    seccompProfile:
      type: RuntimeDefault
  enforcement:
  - name: envoy
    type: envoy
    enabled: true

kubectl apply -f runtimeprofile.yaml

Deny one domain, enforced:

# policy.yaml
apiVersion: scrutineer.sh/v1alpha1
kind: AgentPolicy
metadata:
  name: deny-example
  namespace: default
spec:
  mode: enforced
  deniedDomains:
  - example.com

kubectl apply -f policy.yaml

The agent is plain busybox — it doesn’t know Scrutineer exists. It tries the denied domain:

# session.yaml
apiVersion: scrutineer.sh/v1alpha1
kind: AgentSession
metadata:
  name: first-session
  namespace: default
spec:
  task:
    description: Try one denied egress and exit
    prompt: noop
  model:
    provider: openai
    name: gpt-4.1
  runtime:
    orchestrator: kubernetes-job
    image: busybox:latest
    command:
    - sh
    - -c
    - |
      wget -q -O /dev/null http://example.com/ \
        && echo "egress succeeded" \
        || echo "egress blocked"
      exit 0
  runtimeProfileRef:
    name: enforced-egress
  policyRefs:
  - kind: AgentPolicy
    name: deny-example

kubectl apply -f session.yaml
kubectl get agentsessions -w        # Pending → Running → Succeeded

While it runs, kubectl get pods,networkpolicies shows the agent pod, the first-session-egress proxy pod, and two NetworkPolicies: the routing lock on the agent, a backstop on the proxy.

kubectl get agentsession first-session -o jsonpath='{.status.policyDecisions}' \
  | jq '.[] | select(.phase=="runtime")'

{
  "type": "network",
  "target": "example.com",
  "action": "deny",
  "assuranceLevel": "observed",
  ...
}

(The reporter batches; if the output is empty, wait a moment and re-run. The select skips merge-phase entries — control-plane records of how your policies were resolved — and keeps what the proxy observed.)

observed = reported by the proxy under its own identity. The agent can’t forge or suppress it; anything the agent submits is stamped self-reported instead. (Why.)

The block itself, at the proxy:

kubectl logs first-session-egress -c envoy | grep example.com   # → 403

One field turns enforcement into rehearsal — traffic flows, the denial is recorded as dry-run. Flip the policy, then run a second session under it:

kubectl patch agentpolicy deny-example --type merge -p '{"spec":{"mode":"audit-only"}}'
sed 's/name: first-session/name: first-session-audit/' session.yaml > session-audit.yaml
kubectl apply -f session-audit.yaml
kubectl get agentsessions -w

Same agent, same rule: this time the wget goes through. Read the new record:

kubectl get agentsession first-session-audit -o jsonpath='{.status.policyDecisions}' \
  | jq '.[] | select(.phase=="runtime")'

"action": "dry-run" — still observed. And first-session still holds its deny: re-run step 6 and compare them side by side. Mode changed what happened, never what was seen.

A second session — not a delete-and-rerun — on purpose: the session object is the audit record, and today the evidence lives only in its status. Delete the session and the record is gone. Rerun by creating a new session; keep the old one.

kubectl delete -f session.yaml -f session-audit.yaml -f policy.yaml -f runtimeprofile.yaml
kubectl delete -k config/default

(config/default includes the CRDs, so the second command removes everything — including any sessions still on the cluster, and their evidence with them.)

The mechanism — yes, deliberately so. Scrutineer’s data plane is commodity on purpose: a per-session Envoy and a default-deny NetworkPolicy, portable to any conformant cluster. A competent team can stand that up in an afternoon.

The product is what makes the mechanism a guarantee:

Build all of that and you haven’t disproven the product — you’ve rebuilt it.

The strongest existing alternative — and a fine CNI under Scrutineer; the probe will happily verify it. The differences are the layer above:

• Portability — Scrutineer’s guarantee is CNI-agnostic; toFQDN ties policy to one CNI.
• Name semantics — toFQDN maps DNS answers to IPs, with the races that implies. Scrutineer’s proxy is handed the name and resolves it itself.
• Flows vs. evidence — Hubble exports flows. Scrutineer records identity-authenticated decisions bound to a session object, with assurance labels.
• No session model — admission gating, approvals, audit-vs-enforce, one API object per run.

No — the design assumes it won’t. Proxy env is injected so well-behaved HTTP stacks route automatically; everything else gets nothing. Direct connections die at the CNI, DNS doesn’t resolve. Through the proxy, or nowhere — security holds at zero cooperation; cooperation only buys the agent functionality.

One pain deliberately avoided: Envoy tunnels TLS rather than intercepting it — no MITM CA to distribute, certificate pinning keeps working.

Covered when the client can speak an HTTP CONNECT tunnel (most can, or can be wrapped): same proxy, same policy, same lock, same observed evidence. Recipes: non-HTTP egress guide.

Tools that honor no proxy config at all fail closed — no egress rather than ungoverned egress. Transparent interception for those is future work.

Every transparent option costs privilege somewhere sensitive: iptables in the agent pod needs NET_ADMIN in the workload being governed; node-level interception needs a privileged data plane on every node; CNI-native redirect couples the product to one CNI. The explicit proxy adds nothing privileged anywhere.

It also sees destinations as clean names — the policy vocabulary — where transparent interception sees addresses and reconstructs names from SNI or DNS correlation. The trade: proxy-oblivious tools fail closed until the transparent backend exists. But the steering mechanism was never the security boundary — the lock is.