Paths by role

The documentation is organized by Diátaxis mode — tutorials, how-to, reference, explanation — because that is how docs stay usable. But people arrive with a role, not a mode. These are the five paths through the same pages, in reading order.

Platform engineering — install it, operate it

You own the deployment: uptime, backups, upgrades, capacity.

1. See it work: the quickstart (five minutes), then the zero-to-graph tutorial if you want the guided version.
2. Install for real, by scenario: single node (systemd) · Docker Compose · Kubernetes/Helm with HA · air-gapped.
3. Wire signals: connect a source, then the per-connector guides (pgAudit, CloudTrail, eBPF/Tetragon).
4. Operate: monitoring & SLOs · backup & restore · troubleshooting.

Reference you will live in: configuration, CLI, connectors & tiers.

Security engineering — govern it, contain it

You own least privilege, enforcement and incident response for the agent estate.

1. The model first: what the access map is and honesty & limits — what the product will and will not claim.
2. Govern: govern and approve (RBAC, the restrict-only PDP, recorded decisions), then the recipes: deny-closed policies · HITL approvals · drift triage.
3. Enforce on the agent surface: Claude Code hooks & the PEP · MCP governance · budgets as guardrails.
4. Contain: the kill-switch drill, and harden the deployment.

Deep background: the security model and threat model.

Compliance — evidence, audit, residency

You answer to auditors and regulators; you need records that prove themselves.

1. What the evidence is: the recorded-decisions guarantee in govern and approve — the append-only, signed ledger under every decision.
2. Get it out: push it to your SIEM, or pull/tail it for WORM archival — and verify it offline (troubleshooting § ledger).
3. Keep it survivable: backup & restore — continuity-safe bundles, the off-box key rule, the restore drill.
4. Residency and provenance: air-gapped operation · verify a release · open core & licensing.

The honest baseline to cite in assessments: Honesty & limits — what runs, what is on-demand, what is design-stage.

Running it yourself — one machine, one person

No platform team, no compliance office: a homelab, a home server, a freelance or small-business setup where the person installing it is also the person using it. Nothing here is a smaller product — it is the same single binary, read in the order that gets one machine useful fastest.

Deploy with Docker One compose file, one container, your own machine. The shortest path from nothing to a running control plane.

Quickstart First run, first agent, first governed session — the ten minutes after it starts.

Cost & budgets What your models are costing you, per agent and per session, with budgets that answer before the invoice does.

Back up and restore The one operational habit worth having on day one, whoever owns the box.

Builders — extend it

You are writing a connector or driving the API.

Build and ship a connector Scaffold, implement, sign, distribute — with deny-closed signed admission.

Use the client SDKs Go, Java, Python and TypeScript clients over the published REST contract.

Manage as code The Terraform/OpenTofu provider over the governed API.

API & events reference The OpenAPI-rendered REST surface and the AsyncAPI event bus.