Where Agent Guard fits in Jozu

Agent Guard is one part of a longer pipeline. Together with KitOps, ModelPack, and Jozu Hub, it covers AI artifact packaging, distribution, runtime enforcement, and audit. Each piece does one thing.

The pipeline

KitOps (open source CLI) -> packages AI/ML projects into ModelKits
    |
ModelPack (CNCF specification) -> the standard ModelKits conform to
    |
Jozu Hub (registry) -> stores, scans, and signs ModelKits
    |
Agent Guard (runtime) -> pulls signed artifacts and enforces policy

KitOps packages. ModelPack standardizes. Hub governs distribution. Agent Guard governs runtime. The interface between every pair of stages is the OCI artifact, which means you can swap any stage out for a different OCI-compliant tool and the rest still works.

ModelKits as the unit of distribution

Everything Agent Guard pulls is a ModelKit: agent definitions, MCP servers, policy bundles, skill packages, and (in some workflows) model weights themselves. ModelKits are OCI artifacts. They work with any OCI-compliant registry and any container infrastructure your organization already runs.

The packaging is open source. KitOps is a CNCF Sandbox project and ModelPack is a CNCF specification. You can pack and inspect ModelKits with the kit CLI directly, without Agent Guard or Hub in the picture. If you have packed a container image, you already have most of the mental model.

How Hub fits in

Hub is the registry where the ModelKits live. It does three things Agent Guard depends on.

• Scans every artifact. Five integrated scanners assess models, agents, and MCP servers for security issues that container scanners do not catch (serialization attacks, backdoored weights, prompt injection patterns, license issues). See Security Scanning for the threat categories. Scan results are signed attestations attached to the artifact, not separate reports.
• Signs artifacts cryptographically. Hub uses cosign to sign every artifact it stores and attaches signed attestations for scans, imports, and any custom claim you bind to the artifact. Agent Guard verifies these signatures at admission time when you configure trusted keys, so a tampered artifact is rejected before it reaches the runtime.
• Centralizes audit data. When Agent Guard is connected to Hub, policy decisions and tool-call audit records sync to Hub's audit repository. Disconnected Agent Guard instances buffer locally and sync when connectivity returns.

The public Hub at jozu.ml is free and works well for individual users. The free tier does not support customized security scans, shared organizations (each user can only publish under their own account), custom deployment artifacts, or large-scale storage. Organizations that need any of those run a private Hub. Contact Jozu for private Hub access.

See Picking a Hub for how to point Agent Guard at a private Hub.

Audit

A single tool call inside an Agent Guard microVM produces an audit record. The agent's hook calls the Agent Guard AI Gateway with the tool call. The gateway evaluates against the loaded policies and records the decision. The record is written to ~/Library/Logs/AgentGuard/policy_audit.jsonl. If Agent Guard is connected to a Hub, records are also forwarded to Hub's centralized audit repository on a recurring schedule.

Audit records carry the agent name, the workspace, the tool, the arguments, the matched rule (if any), the action taken, and a cryptographic chain to the previous record. The chain makes the log tamper-evident: removing or modifying a record breaks the chain and is detectable on review.

For individual users running locally, the JSONL file is enough. For organizations that need centralized audit across many developer machines and CI runners, the Hub-side audit repository is the single source of truth.

Air-gapped operation

Agent Guard does not require connectivity to enforce policies. Policies, agent definitions, and MCP servers are all OCI artifacts that can be pulled once and cached locally. After the initial pull, evaluation happens entirely in-process inside the microVM, with no remote calls.

The same applies to Hub. A private Hub deployed inside an air-gapped network distributes ModelKits to the Agent Guard instances on that network using the same OCI flow that the public Hub uses outside one. There is no degraded mode and no compromise on what gets enforced when connectivity is lost.

This is the architectural property that matters most for federal, defense, and regulated deployments. Policies travel with the artifacts and enforce locally, regardless of whether the host can reach any remote service.