A self-hosted governance service that scores AI agent traces for risk — prompt injection, unapproved write actions, sensitive data — and routes anything risky into a human approval queue with a durable audit trail.
Teams shipping AI agents into real workflows need to know when an agent did something risky, and to gate risky actions behind a human — without bolting together a dozen separate observability tools.
A three-tier app: agents and pipelines POST traces to a REST API, a governance engine scores each one against 8 weighted rules, and a reviewer dashboard surfaces anything that needs a decision.
Node HTTP server (built-ins only, no framework) → a single shared governance-engine module → SQLite via node:sqlite. The same engine module scores on ingestion, renders the dashboard, and is exercised by the test suite, so the risk shown can never drift from what's stored.
Keeping the governance engine as one module used by the server, the browser, and the tests — so the dashboard's score can never disagree with what's persisted. Chose zero runtime dependencies and Node's built-in SQLite to keep the Docker image tiny and installs instant.
How to design a scoring rubric transparent enough to defend in an audit — every rule has a name, a category, and a weight — instead of a black-box number.
Source repository
Back to the portfolio