Four projects that form one system for policy enforcement, governed memory, automated evaluation and human oversight.
AI agents call tools, and tools have consequences. An agent with access to your filesystem, email, database, and cloud APIs is one hallucination away from an irreversible action.
The current answer is either trust everything (dangerous) or approve everything manually (doesn't scale). Between "allow all" and "human in the loop for every call," there's a gap with no standard infrastructure to fill it.
flux7 fills that gap with a layered governance system that handles the routine automatically and escalates the ambiguous to humans.
L0 flux7-mesh Policy engine allow / deny / escalate <1ms
│
│ pending approval
▼
L1 flux7-mesh Memory lookup read, 3+ human yes → allow ~100ms
│
│ novel case
▼
L1+ flux7-supervisor Rules + decision model approve / deny / escalate ~350ms
│
│ uncertain
▼
L2 Human Console UI / Claude Code final decision minutes
│
▼
flux7-memory Decisions as facts remembered for next time
Each layer reduces the load on the next. Most tool calls never reach a human.
Enforces what agents can do with YAML policies (first match wins, glob patterns), an approval queue, rate limiting and JSONL tracing. It runs as one binary with one config file and fails closed.
Remembers what happened in a persistent, searchable, governed memory, with hybrid search (BM25 + dense cosine + LLM reranking). Decisions are stored as queryable facts.
Evaluates what's ambiguous. Polls pending approvals, applies rules, then asks a decision model narrow typed questions (Jev, with the same questions on a local model through Ollama as fallback, behind a circuit breaker) and decides in code from the probabilities. Thresholds are measured on a bench.
Shows it all and lets humans intervene through a dashboard, an approval UI, a trace viewer with chain of authority and integrity check, a memory browser and an OTEL waterfall. It is the management plane for the entire system.
Each step is independently valuable. No project requires the others to function.
| Cloud agent platforms | MCP / AI gateways | In-process middleware | flux7 | |
|---|---|---|---|---|
| Examples | AWS AgentCore, Gemini Enterprise, Microsoft Agent 365 | Kong AI Gateway, agentgateway | Microsoft AGT, LangSmith | mesh7, mem7, sup7, console |
| Scope | Agents in that cloud | Any MCP client over HTTP | Agents in that process or framework | Any MCP client, stdio and HTTP, plus REST |
| Tool policy | Deterministic, in their perimeter | Per tool, from token identity and scopes | In the agent's code | Per agent and per tool, on the arguments |
| Human approval | Built in the application | Not at the gateway | Escalate verdict, wired by you | Approval queue outside the agent, stdio included |
| Past decisions | Current session | None | None | Human precedents kept as facts, across sessions |
| Automated judgment | Guardrails on model traffic | Guardrail plugins on LLM routes | Policy and trust scoring | Rules, then a decision model with measured thresholds |
| Self-hosted | No | Yes (enterprise licence for some) | Yes | Yes, Apache 2.0, single binary |
Snapshot of September 2026; this field moves every week. Gateways and flux7 compose rather than compete: a gateway checks who calls which tool, and flux7 judges the call itself. The Keycloak and Kong example runs mesh7 behind a Kong node.