Quilzo

Inspiration

Most agent frameworks hand a model your tools and a system prompt asking it to behave. Then the model reads a web page, an email, or a support ticket somebody else wrote, and does what it says. I wanted the opposite starting point: the model never holds the authority. Authority lives in a reviewable declaration, enforced outside the model, and a person decides before the actions that matter. I also noticed agents need something real to read and write, so the control plane grew a governed content platform underneath it.

What it does

Quilzo is a self-hosted control plane for AI agents and the content they produce. One Go binary, no third-party dependencies, that gives every agent:

• Identity and accountability: each agent is a principal answered for by a named sponsor, until a date.
• A declaration, not a prompt: purpose, capabilities, what content it may read, budgets in steps, calls, time, tokens and money, and autonomy level, all enforced at one gate on every action, whichever model or sandbox the agent runs on.
• Ask first: capabilities under ask_first stop the run; a person sees the exact call and approves precisely that call and no other.
• An exfiltration breaker: a run holding private material that has read somebody else's words cannot call out without a person.
• Signed receipts: every run, app call and erasure comes as a record with inclusion proofs against a log head signed with Ed25519 and ML-DSA, verifiable by anybody.
• Governed memory: per person, per agent, with trust tiers, taint holds, and the right to see, rewrite or erase what agents remember about you.
• A model gateway that routes to any OpenAI-compatible endpoint, masks personal data before prompts leave, and budgets each caller.
• RAG chatbots that cite every sentence, screen planted instructions out of what they read, and can hand a conversation to a person.
• MCP gateway and A2A: your tools pinned, per-role access, every call recorded, other vendors' agents registered by their agent cards.
• Security operations and compliance: detections, cases, incidents with regime clocks, posture checks read as EU AI Act and ISO/IEC 42001 evidence, SBOM, and a shield that defends the installation itself.
• An agentic CMS: immutable, content-addressed pages, publish by pointer, review approvals, rollback, provenance marking AI-written content, typed data, media with C2PA, forms, and a catalogue shopping agents can read.

How I built it

• One static Go binary, standard library only, no third-party dependencies; the few bundled assets (a typeface, icons, public data sets) are credited in NOTICE.
• The gate as the core: a single enforcement point that every action passes through, identical from the browser, the command line, MCP and A2A, so limits hold outside the model.
• Agents in a box: an agent's own program runs confined with user, process, network and mount namespaces, Landlock, seccomp, dropped capabilities and rlimits, reaching Quilzo, a model and its hosts only through what is handed in.
• A signed, hash-chained audit log with inclusion and consistency proofs, optionally written by a separate user the content platform cannot impersonate, anchored in time and encrypted at rest.
• Measured, not asserted: against AgentDojo v1.2.1, assuming the model is fully hijacked and asking only the gate, 26/26 attacks were refused, 71/97 tasks completed unattended, 26 needed a person, and none were refused outright. The scoring script reproduces in seconds with no API key.
• Runs kept and replayable: every step checkpointed as it happens, so a run can be continued, replayed from any step, and proved afterwards.

Challenges I ran into

• Making limits real rather than prompt-shaped: the gate has to decide from the declaration, not from what the model promises.
• Designing the exfiltration breaker so that "read something untrusted, then send something private" is caught even when the sending call itself looks allowed.
• Earning autonomy safely: a model drives an agent only after evaluations with planted instructions show it is not steered, and drops back the moment it follows one.
• Keeping memory governed without making it useless: trust tiers, taint holds and lapsing facts, while letting people inspect and erase what agents remember about them.
• Doing all of this with zero dependencies in a single binary, and keeping every command honest with --json and distinct exit codes.
• Being solo meant every one of these decisions was mine: no one to argue with, so I leaned on writing the reasoning down in the docs and letting the evaluations argue back.

Accomplishments I'm proud of

• A hijacked model can only do what its declaration allowed before anybody talked to it, and what it read, remembered, spent and was refused is in a signed log you can prove things from.
• 100% of AgentDojo injection attacks refused at the gate under the worst-case assumption, with the method and its weaknesses published for reproduction.
• Receipts anybody can verify against published keys, not just trust me.
• A full CMS underneath, so agents work on real content with review, rollback and provenance, not a toy sandbox.
• It runs on a laptop with a local model or on a server with the providers you already pay for. And one person built, measured and documented all of it.

What I learned

• Declarations beat prompts: a reviewable document the model picks from, and cannot add to, is easier to reason about than instructions in a system prompt.
• The interesting attacks shape the arguments of a call the agent was allowed to make, so the gate has to know what the run has read, not just what it is calling.
• Autonomy should be earned and revocable, not configured once and forgotten.
• Provenance and receipts turn "I think it behaved" into "here is the proof", which is what compliance people actually ask for.
• One binary with no dependencies is a constraint that pays for itself in auditability and deployment.
• Working solo, writing things down early (docs, threat model, evaluation scripts) was the cheapest way to get a second opinion.

What's next for Quilzo

• Signed release binaries for Linux, macOS and Windows on amd64 and arm64, plus a published container image (no release is out yet; build from source today).
• Growing the community: Quilzo wants maintainers, not only patches; three merged pull requests of substance gets you commit access under the rules in GOVERNANCE.md.
• Deepening the experimental conversation and calls work: rooms, end-to-end encrypted calls and screen sharing, and the lawful-bounds note-taker.
• More coverage in evaluations, detections and framework mappings, and more organisations running the AI Act and ISO/IEC 42001 evidence straight from what their agents actually did.

Built With

• css3
• go
• html5
• javascript
• python