System architecture

Nemesis intercepts an AI agent action before it executes and denies what is destructive or malicious.

Prompt instruction is probabilistic (the agent can ignore it); enforcement via exit 2 is deterministic. Three independent layers. Everything 100% local.

The flow, start to finish

From the agent action to allowing, blocking or quarantining.

Nemesis flow: the agent attempts an action; layer 1 (pretool) blocks the hostile one with exit 2; layer 2 (daemon) quarantines what escaped; layer 3 (eBPF, kernel) is the safety net; everything is logged locally. — Layer 1 blocks before execution (exit 2). Layer 2 isolates what escaped (quarantine). Layer 3 holds in the kernel if the pretool falls (-EPERM).

The three layers, side by side

When each one acts, where, what it does and what it catches. Independent: if one fails, the next holds.

The concepts, one by one

The same diagrams each concept page consumes live in the diagramas/ folder.

Three independent layers; decision by corroboration (one confirmatory signal suffices, a heuristic needs two types); reversible quarantine; protection is the sum of layers, the coefficient. — Decision and defense in depth. Each onboarding concept has its own diagram in `diagramas/`.