Portable, self-hostable data sovereignty for agentic AI

Your agents.
Your rules.

Keep authority over your code, tools, and data. Anthesis puts explicit policy between an agent’s intent and its actions.

Define how agents access, modify, and transmit your resources. An independent, deterministic decision must be enforced by the tool, gateway, or isolated runtime that actually performs the action.

Try Anthesis — run a governed action Explore the boundary

Independent of the model. Dubnium is one optional personal-system integration, not a prerequisite.

Explicit authorityDeterministic decisionsBounded executionTraceable outcomes

Local-first by design

Keep your data under your authority, from a laptop to a self-hosted system.

Define which agents can reach which resources, which changes need approval, and where protected data may be sent. Apply the same authorization contract to a developer's repository, a personal AI system, or a selected enterprise workflow. The runtime must enforce the policy at actual execution and data-transfer boundaries.

Individual developer · target integration

Keep a local coding agent within your repository policy.

Run a model using Ollama on a MacBook and use an agent that proposes file, shell, Git, and network operations. An Anthesis adapter can authorize specific paths and commands, require approval for sensitive changes, and deny out-of-scope effects.

Current status: This is the intended portable developer workflow, not a claim that a turnkey Ollama/MacBook sandbox has shipped. The public reference trial uses a constrained tool registry and a disposable Git repository; it is not universal agent containment.

Personal AI system · reference use case

Use Anthesis to govern a personally operated AI system.

Dubnium is a personal, self-hosted system for running local models, coordinating agents, and operating tools on infrastructure its owner controls. It provides a concrete use case for Anthesis authorization across a broader personal environment—not the required way to run Anthesis.

Availability: Dubnium is currently a personal system and reference integration, not a generally available product. A public release may follow in the future; no release or support commitment is implied. Its runtime owns execution and isolation; Anthesis owns policy authority.

Existing agent platforms · integration profile

Add a common decision boundary to selected high-impact actions.

Evaluate an adapter for an existing agent or workflow at the point where it changes a repository, invokes a privileged API, publishes an artifact, or sends data to an external service.

Boundary: Platform-native governance remains relevant. Anthesis cannot control actions that bypass the selected adapter or reach the same resource directly.

One protected action: from model proposal to the source of truth

  1. Model and agentPropose a write to a source file.
  2. AnthesisBind actor, target, policy, and approval to the exact proposed effect.
  3. Enforcing adapterReject the operation or execute it with the permitted scope.
  4. Source of truthChange the repository and record the observed outcome.

Sovereignty boundary: A local policy decision does not guarantee local data handling or complete containment. If an agent or its tools retain direct shell, filesystem, network, or credential access, they may bypass Anthesis or send protected data elsewhere.

Read use cases, integration boundaries, and platform responsibilities →

Data sovereignty, in practice

Keep control where your data lives.

Choose where agents run.
Define what they can touch.
Decide what can leave.

Anthesis supplies policy decisions for protected actions. Your model endpoint, agent runtime, filesystem, credentials, network and storage must enforce the surrounding data boundary.

Local inference alone does not prevent unauthorized tool access or data egress.

Responsibility boundaries

Reasoning is flexible. Authority is explicit.

An agent can propose an action without being permitted to perform it. Anthesis makes that decision separate and inspectable.

Anthesis ecosystem responsibilities
ComponentResponsibility
AnthesisPolicy authority, deterministic evaluator semantics, approval requirements, capabilities, evidence semantics, and provenance.
Governance LabIndependent conformance, synthetic scenario packs, inference-integrity fixtures, reports, and walkthroughs. It does not execute production effects.
DubniumPersonal AI system and reference runtime for models, agents, governed tools, execution, and runtime evidence. It consumes decisions and does not define policy authority; it is not a required Anthesis component.

Start here · runnable reference trial

Run an authorized write. Attempt a bypass.

Use the public Governance Lab's signed evaluator and constrained reference runtime to inspect one real mutation in a disposable Git repository and two hard-denied attempts.

Two commands, then inspect the evidence

Clone Anthesis Governance Lab, then run these commands from the repository root:

bash scripts/acquire-anthesis-lab.sh
bash scripts/run-reference-trial.sh

Inspect the repository diff and decision/outcome JSON. The runtime exposes only the governed repository writer for this effect; the raw writer is not registered.

Open the complete Try Anthesis walkthrough →

What the trial demonstrates

Authorized The exact permitted file write produces an inspectable diff and decision/outcome evidence.

Denied A raw tool call and an out-of-scope file path are blocked with repository state unchanged.

Boundary: This local harness does not prove containment against a hostile OS user or an arbitrary runtime with direct shell, filesystem, network, or credential access.

Runnable public proof

Reproduce the decision contract independently.

Governance Lab evaluates declared attempts and recorded evidence deterministically; it does not execute the declared production effects. Dubnium is a personal self-hosted AI system that provides one separate bounded runtime integration, not a requirement for using Anthesis or a generally available product.

Runnable now

7 canonical governance scenarios

Stable public conformance fixtures for deterministic allow, approval-required, policy-deny, and engine-guard outcomes.

Open the operator runbook →

Runnable now

9 packs / 27 scenarios

Broader synthetic governed-action coverage across documentation, source, CI/release, dependencies, secrets, tools, runtimes, administration, and adversarial declarations.

Inspect the demo packs →

Runnable now

24 inference-integrity scenarios

Recorded provider-neutral evidence for identity, seed/token integrity, verifier trust, routing, supervisor/specialist localization, re-verification, operating modes, and recovery.

Open the inference-integrity runbook →

Reproduce everything: use the Governance Lab full-verification runbook for signed evaluator acquisition, expected counts, controlled mismatch checks, evidence generation, and checksums.

Integration assurance

Enforcement depends on the bypass paths you close.

Tool wrappers, MCP mediation, gateways, capability validation, and sandboxes can all host governance boundaries. The runtime must make the chosen boundary authoritative.

Anthesis integration enforcement locations and assurance conditions
ModeEnforcement locationRequired bypass controlTypical assurance
Tool wrapper / invokeTool surfaceRaw effectful tools are unavailable to the agent.Moderate to strong
MCP mediationTool surfaceRaw downstream MCP servers, credentials, and direct service paths are unavailable or constrained.Moderate to strong
Gateway / sidecarInfrastructureDownstream effects are unreachable except through the governed gateway.Strong
Capability tokensInfrastructure / downstream toolEffects reject missing, expired, altered, replayed, or out-of-scope grants.Strong
SDK wrapperApplicationDirect clients and raw credentials are blocked or the mode is explicitly advisory.Advisory to moderate
Sandboxed runtimeRuntimeFilesystem, network, process, credentials, and tools are unavailable outside governed paths.Runtime-enforced when complete

What prevents the agent from producing this effect without crossing Anthesis? The table is a reference, not an assurance guarantee for a particular deployment.

Read the integration modes →

Different responsibilities, possible integrations

Where Anthesis fits alongside other AI platforms.

These products operate at different layers; this is a responsibility map, not a security ranking. Bedrock AgentCore, UiPath, and Microsoft products include native governance capabilities that may overlap with Anthesis.

Comparison of model serving, agent orchestration, governed execution and business automation responsibilities
SystemPrimary roleRelationship to Anthesis
OllamaLocal model serving and tool-call generation.The agent application executes tool requests. Anthesis can govern selected actions through a mediated integration; Ollama alone is not that enforcement boundary.
AnthesisPortable authorization, approval, and decision/evidence contracts.Evaluates exact effects independently of the model; requires an enforcing integration for the selected action.
DubniumPersonal self-hosted AI system for local models, agents, and tools; a possible future public release.A personal use case and reference consumer of Anthesis authorization, not a released product or Anthesis dependency.
Amazon Bedrock / AgentCoreManaged model and agent infrastructure, including gateway policy controls.Overlapping native authorization capabilities. Anthesis is an optional external decision boundary only for effects a real integration mediates.
Amazon SageMaker AIMachine-learning training and model deployment infrastructure.A potential model-lifecycle or execution provider; not a replacement for an independent exact-action authorization contract.
Microsoft Copilot StudioBuilding and managing agents and workflows with enterprise connectors.Its native governance applies inside its own supported surfaces. Anthesis would need an explicit adapter to govern selected effects.
UiPath / MaestroOrchestrating AI agents, software robots, and people in business processes.Existing workflow and governance controls may be sufficient; Anthesis could add a shared external policy boundary where independently justified.
Microsoft Power PlatformBusiness applications, automations, agents, and data integration.A possible source or destination for selected governed actions, subject to its own identity, connector, and policy controls.

Data sovereignty is an end-to-end property: Anthesis helps the resource owner set and evaluate rules for access, mutation, and transmission, but locally hosted authorization alone does not keep source code or prompts on-device. The agent, model endpoint, tools, telemetry, credentials, and external transfers must also be constrained within the chosen trust boundary.

Integration status: This table describes architectural relationships, not a claim of released adapters or universal enforcement across the listed products. Read the detailed responsibility map →

Current maturity

Use precise claims for each layer.

Public materials distinguish deterministic evaluation, bounded reference execution, and broader production assurance.

Runnable now

Deterministic public validation

Signed evaluator acquisition, 7 canonical scenarios, 9 packs / 27 scenarios, 24 inference-integrity scenarios, reports, controlled mismatch exercises, and reproducible evidence.

Reference integration

Dubnium: a personal AI system

Dubnium demonstrates one self-hosted composition with exact authorization binding, approval-gated constrained tools, and runtime evidence. A broader public release is possible in the future, but is not available or promised today.

In development

Broader production assurance

Additional enforcement profiles and stronger live inference-integrity capture, replay, independent verification, containment, and recovery.

Trust boundary: Governance Lab demonstrates deterministic contract behavior over synthetic declarations and recorded evidence. It does not prove universal effect enforcement or live non-bypassability. Those guarantees depend on the actual integration environment.

Learn more

Good governance should be inspectable.

Run Governance Lab

Use the short stakeholder walkthrough or reproduce every current public proof surface.

Stakeholder walkthrough →
Full verification →

Dubnium personal-system case study

Read how the personally operated Dubnium system provides one reference execution boundary for Anthesis. Dubnium is not required to run Anthesis and is not currently offered as a general-purpose release. The runnable Anthesis trial is separate.

Dubnium public integration reference →

Read the project brief

See the problem, proof model, integration modes, maturity, and adoption path in one concise document.

Project brief →

Read the whitepaper

Longer-form architecture and governance material.

Whitepaper →

Read the engineering notes

Long-form context on the problem, architecture, and public governance proof. This project site remains authoritative for current product status.

24 Scenarios That Prove Your AI Agent Follows Rules →
Anthesis Update: Memory, Governance, and Beyond the SDLC →
AI SDLC: automating the grind →
All Anthesis posts →