Documentation
Build, run and govern with Olivares AI
Guides, concepts and reference for Olivares AI — discover, map, govern and audit the AI agents on your own infrastructure. Self-hosted, open-core.
Getting started
-
What is Olivares AI?
An open, self-hostable platform that discovers the AI agents on your own infrastructure, maps what each can read and write, and lets you govern and audit that access.
-
Quickstart
From zero to a populated read/write access graph in about five minutes, using the built-in demo estate. One static binary, no external services.
-
Install & self-host
Production install of the single Olivares AI binary — no default credentials, TLS on by default, /readyz and /livez probes, SQLite or least-privilege Postgres
-
Honesty & limits
What Olivares AI does today, what is design-stage or pre-1.0, and what the platform deliberately does not do — the trust contract the rest of these docs hold to
Core concepts
-
The read/write access map
How Olivares AI models agent access as a typed read/write graph, diffs permitted against observed, and stays honest about coverage and attribution.
-
Permitted vs Observed
The diff at the heart of the access map — what an agent is granted versus what it is seen doing — surfacing unexpected access and unused grants
-
Coverage & attribution fidelity
How Olivares AI labels every access-map edge with two honest axes — how well a source proves read vs write, and how firmly the access ties to one agent
-
Governance: read-first & deny-closed
How Olivares AI observes before it enforces, governs actuation deny-closed by default, applies risk tiers with a dual-control floor, and ties to a kill switch
Guides
-
Connect a source
Wire a real observation source into Olivares AI, understand the read-first connector model, and configure pgaudit and s3cloudtrail with the correct source kinds
-
Connect Claude Code
Ingest Claude Code sessions from OpenTelemetry gen_ai telemetry and govern its tool-calls at a deny-closed enforcement point, with governance data kept on-prem
-
Govern & approve
How Olivares AI governs agent access with risk tiers, dual-control on high-risk actions, audited break-glass, and an append-only ledger of every decision
-
Verify a release
Prove an Olivares AI release is the one we published — verify its signature, SLSA provenance, SBOM and OpenVEX attestations, fully offline with no network
Reference
-
Modules catalog
The 27-module catalog of Olivares AI — what each module governs and observes, and where actuation is live, provisioned on demand, or still a deny-closed seam
-
CLI
The olivares CLI — the single self-hostable binary's verified top-level commands and the secure-by-default serve flags, including --seed-demo
-
Configuration
The real configuration surface of the Olivares AI control plane — store backend, TLS, sources, audit signing key, and tenancy, with fail-closed defaults