One run, two sessions, same plain-busybox agent: one enforced, one audit-only.
You’ll see a denied request rejected live, a bypass attempt die in the kernel, and all
of it recorded as evidence the agent couldn’t forge.
0 · Prerequisites
A quickstart cluster that ended VERIFIED, with
internet egress (the demo fetches example.com).
1 · Run it
make demo
Applies one hardened RuntimeProfile, two AgentPolicy objects differing only in
mode, and two sessions running the same busybox agent — nothing in the image
cooperates with enforcement. Each agent probes three paths and prints what it
experienced (~2 minutes):
| probe | demo-enforced | demo-audit |
|---|---|---|
example.com via the proxy (allowlisted) | SUCCEEDED | SUCCEEDED |
example.net via the proxy (not allowlisted) | BLOCKED | SUCCEEDED, recorded as dry-run |
| direct DNS, skipping the proxy (bypass attempt) | BLOCKED | BLOCKED |
Notice: the proxy env is a convenience, not the control — the default-deny
NetworkPolicy is why the bypass dies. And it dies in both modes: audit-only
relaxes blocking, never the routing lock, or the observations couldn’t be trusted.
2 · Read the evidence
make demo ends by printing status.policyDecisions for both sessions.
- action —
deny(enforced) vsdry-run(audit) forexample.net. Mode changed what happened, never what was seen. - assurance — every entry is
observed: reported by the proxy pod under its own identity. The agent has no path to inject or launder evidence. (Why.) - what’s absent — the bypass attempt left no entry. The CNI drops it silently; recording attempts unforgeably is a tracked roadmap item, stated rather than hidden.
Dig further:
kubectl get agentsession demo-enforced -o yaml
kubectl get events --field-selector involvedObject.name=demo-enforced
kubectl get pods -l scrutineer.sh/session
3 · Honest boundaries
- External TLS is tunneled: filtering is by domain, not request bodies.
- Tool and file governance have no enforcement backend yet — removed rather than shipped as advisory; they return as out-of-pod chokepoints.
- The guarantee assumes an enforcing CNI (proved by the gate) and an uncompromised node — spelled out in the design docs.
4 · Clean up
make demo-down # remove the demo sessions/policies/profile
make quickstart-down # delete the kind cluster entirely
Next: install on your cluster — the same story, every command visible, on your own cluster.