This page is not a checklist contest. The long form, with vendor quotes and their sources, is on the sibling pages. This is the shape.
What it is
A self-hosted kernel (one artifact) that:
- Discovers agents and builds a read/write access map
from native audit and the telemetry you configure, out of band. Coverage is
tiered —
clean,lossyoropaque— and attribution isfirm,approximateorunknown. Nothing is guessed. - Holds policy and optional deny-closed enforcement points you wire.
In current development those points are the Claude Code hook, an opt-in
inline
/v1/messagesproxy that stays unmounted until you provision it, an MCPtools/callgate and an A2A delegation gate. - Writes an append-only, hash-chained audit ledger with Ed25519-signed checkpoints, exportable for offline re-verification, and pushes it to a SIEM sink when you configure one. That is tamper-evident evidence, not an immutable WORM store unless you configure WORM archival.
- Can bind an agent to an existing non-human identity, or mint a dedicated one. A dedicated NHI is what lets the access map attribute access firmly; a shared account stays approximate; an unresolved identity is never silently treated as a real NHI. Roster connectors read your IdP’s and the hyperscalers’ agent registries as read-only snapshots — Olivares does not become your IdP.
What it sits beside (not instead of)
| Layer | Typical tools | What Olivares does not do |
|---|---|---|
| Model-call path | LiteLLM, Cloudflare AI Gateway, Portkey, Bedrock Guardrails | Route, cache, load-balance, or filter content |
| Host / runtime | eBPF, existing APM | Replace the tracer or store full OTel spans |
| Control towers | Microsoft Agent 365, ServiceNow | Replace the tower; federation is read-only snapshot ingestion, not live-verified trust |
| Identity | Entra, AWS, Google, SPIFFE | Be an IdP |
Sourced comparisons: vs AI gateways, vs LLM observability, vs control towers, vs Bedrock AgentCore, vs Microsoft AGT, vs WitnessAI.
Honest limits (repeated on purpose)
- Pre-1.0 preview. Not certified.
- Air-gap is the kernel and its data, not Claude inference.
- The stop is a deny gate the wired surfaces consult, not a process killer, and only as wide as the gates you wired.
- Fidelity is tiered; nothing is guessed.
- Community is the long-term default; commercial add-ons are additive packs, not a wall in front of the AGPL core.
How the pieces fit: how it works. Who it is for: solutions.