Run AI agents on your own terms.
Any agent. Any model. Captive to no one.
Brig, by osnavi — the governance, containment & tamper-evident-audit gateway for AI agents.
▸ 12-slide overview — click or press → to begin
Any agent. Any model. Captive to no one.
Govern any AI agent, run any model, on infrastructure you own — and swap a model the day it gets too expensive or too dumb, without changing anything else.
The gateway stays the same. Your policy, your audit, your egress controls — all unchanged. The model behind it is a single config line.
Switch the model — the governance, audit and controls don't move.
Two captivities, one tool.
Blast radius
An ungoverned agent- Can delete a production database in 9 seconds — one wrong tool call, no undo.
- Leaks secrets to the open internet — keys, tokens, customer data.
- Is hijacked by prompt injection into running an attacker's commands.
Vendor capture
A single-vendor agent & model- Price & availability risk — the bill triples, the model degrades, a tier vanishes.
- Terms you don't control — your code and infra flow through one foreign cloud.
- Surveillance & lock-in — leaving means a migration, so you never leave.
Most tools fix one and deepen the other. Brig addresses both.
Why the usual answers fail.
Shared-kernel CVEs let code escape, and egress is open by default — the agent can phone home.
Not containedA YAML rule is only as good as the human who wrote it. One missed flag and the door is open.
Not guaranteedIf the record can be edited — even by you — it can't satisfy an auditor or a regulator.
Not provableA hyperscaler's built-in agent controls are a lock-in mechanism — more dependence, not sovereignty.
Not sovereignBy construction, not by policy.
The attack isn't blocked. It's impossible. Memory-safe, no-JIT sandbox · no ambient filesystem, network, or secret authority · deny-by-default capability gating.
The two biggest browser-CVE classes — memory corruption and JIT bugs — deleted by construction.
Sandboxed code gets no filesystem, network, or secrets unless a capability is explicitly granted.
Every action is denied until allowed — the safe state is the default, not an afterthought.
Allowed. Denied. Contained.
One command. ~10 seconds. No network. Ordinary work flows; dangerous actions are stopped before they touch your systems.
A log you can prove wasn't edited.
Every decision is written to a keyed (HMAC) hash-chain. Each record seals the one before it, signed with the operator's key.
Edit one record to hide a denied command — and verification catches it. Recomputing every hash fails without the operator key, so the record can't be forged, even by you.
Keyed hash-chain Tampering detected
Change one byte at #3 and every hash after it no longer matches — and you can't recompute them without the key.
Even truncation gets caught.
A hash-chain can't notice if you simply delete the tail — chop the last records and what remains still verifies cleanly.
So Brig signs the head of the chain with Ed25519. The auditor verifies with only the public key — never your secret — and truncation, reordering, or a forged head is caught immediately.
The signed head pins the chain length — drop a record and the signature no longer matches.
Stays on your metal. Signs the head. Never leaves, never shared.
brig anchor-keygenVerifies the signature alone. Catches truncation with zero trust in you.
brig verifyExfiltration blocked — even to an allowlisted host.
A secret is reversed in the sandbox and POSTed to evil.example — which is deliberately on the egress allowlist — and is still blocked. The secret's provenance follows the value across the transform, not its bytes.
Agnostic and sovereign — the uncopyable position.
Any agent over MCP. Any model — local (Ollama / qwen2.5 — nothing leaves the machine) or vendor (under egress + full audit) — swappable in one config line. The US giants can ship guardrails; they can't be the sovereign, non-US, vendor-neutral choice.
The gateway, your actions, and egress stay on your metal. Your code never leaves unless you choose a vendor model.
One flag selects the model. Point it at a local model for full confidentiality, or a vendor under audit — no migration.
Independent, Swiss-rooted, anti-surveillance. A sovereignty halo no US hyperscaler can claim.
Brig already runs a real question through a chosen model — qwen2.5, locally — selected by a single flag. Point the same flag at DeepSeek and nothing else changes.
brig run-task --model qwen2.5
# one line later: a different model, same everything
brig run-task --model deepseek
# or a vendor, under egress + full audit
brig run-task --model vendor:…
It's real, and it ships.
Honest limits
Today brig run confines the agent at your own user — a real boundary; isolating it as a separate, unprivileged user it can't become (privilege separation, for a hostile or multi-agent cohort) is the active next step. And we're not yet third-party pentested — design-partner stage, adversarial review welcome, a pentest the next unlock. We'd rather tell you than have you find it.
Isn't this just a sandbox?
No — a sandbox isolates one process. Brig governs every action across scoped FS, allowlisted egress, a memory-safe runtime with no shared kernel, and produces a provable, replayable audit.
Closed-source, solo — why trust you?
The gateway is open to review under agreement; a sealed source copy can be placed with a neutral third party for continuity; and the durable defense — sovereignty + speed — is one the US giants can't copy. A third-party pentest is next.
A scoped, paid pilot.
CHF 15–30k
60–90 day pilot
Deploy for one team, wire into their agent and SIEM, and deliver the tamper-evident audit + a report. Converts to an annual self-hosted, per-site license.
Stand Brig up for one team, on their own infrastructure.
Connect their agent and SIEM; pick a model — local or vendor.
Deliver the tamper-evident audit and a written report.
Brig, by osnavi — self-hosted · memory-safe · model-agnostic · Swiss-rooted. Run AI agents on your own terms.