Documentation
Build, run and govern with Olivares AI
Guides, concepts and reference for Olivares AI — discover, map, govern and audit the AI agents on your own infrastructure. Self-hosted, open-core.
English reference
Control-plane API reference
Browse the stable contract and the schema-thin beta module route inventory generated from the published OpenAPI specifications.
Open API reference →Getting started
-
What is Olivares AI?
What Olivares AI is: a self-hosted platform that discovers AI agents, maps read/write access and audits decisions on your infrastructure.
-
Quickstart
From zero to a populated read/write access graph in about five minutes, using the built-in demo estate. One static binary, no external services.
-
Install & self-host
Production install of the single Olivares AI binary — no default credentials, TLS on by default, /readyz and /livez probes, SQLite or least-privilege Postgres
-
Honesty & limits
What Olivares AI does today, what is design-stage or pre-1.0, and what the platform deliberately does not do — the trust contract the rest of these docs hold to
Core concepts
-
The read/write access map
How Olivares AI models agent access as a typed read/write graph, diffs permitted against observed, and stays honest about coverage and attribution.
-
Permitted vs Observed
The diff at the heart of the access map — what an agent is granted versus what it is seen doing — surfacing unexpected access and unused grants
-
Coverage & attribution fidelity
How Olivares AI labels every access-map edge with two honest axes — how well a source proves read vs write, and how firmly the access ties to one agent
-
Governance: read-first & deny-closed
How Olivares AI observes before it enforces, governs actuation deny-closed by default, applies risk tiers with a dual-control floor, and ties to a kill switch
Guides
-
Connect a source
Wire a real observation source into Olivares AI, understand the read-first connector model, and configure pgaudit and s3cloudtrail with the correct source kinds
-
Connect Claude Code
Ingest Claude Code sessions from OpenTelemetry gen_ai telemetry and govern its tool-calls at a deny-closed enforcement point, with governance data kept on-prem
-
Govern & approve
How Olivares AI governs agent access with risk tiers, dual-control on high-risk actions, audited break-glass, and an append-only ledger of every decision
-
Verify a release
Prove an Olivares AI release is the one we published — verify its signature, SLSA provenance, SBOM and OpenVEX attestations, fully offline with no network
-
Connect PostgreSQL (pgaudit)
Observe PostgreSQL access with pgAudit: configure logs, stream events, preserve attribution and produce read/write access-map edges.
-
Connect eBPF backstop
Use the eBPF observer for non-cooperative file and network I/O signals, adding clean-tier coverage that does not rely on agent cooperation.
Cookbook
-
Cookbook: kill-switch drill
Run a non-production kill-switch drill: engage the stop, verify denial at actuation points, recover with dual control and review evidence.
-
Cookbook: HITL approval flow
Follow a human-in-the-loop approval from request to decision, including risk tiers, duty separation, plan hashes and break-glass.
-
Cookbook: budget enforcement
Configure AI spend budgets with throttle and block gates, provider cost streams, deny-closed enforcement and cap behavior.
Reference
-
Modules catalog
The module catalog of Olivares AI — what each module governs and observes, and where actuation is live, provisioned on demand, or still a deny-closed seam
-
CLI
The olivares CLI — the single self-hostable binary's verified top-level commands and the secure-by-default serve flags, including --seed-demo
-
Configuration
The real configuration surface of the Olivares AI control plane — store backend, TLS, sources, audit signing key, and tenancy, with fail-closed defaults
-
Documentation languages and versioning
Language coverage, translation review status and the versioning policy for Olivares AI public documentation