Documentation
Platform Overview
Tiresias-ZT is a self-hosted zero-trust PDP/PEP proxy that sits between your AI agents and their memory and MCP backends. Every request is evaluated against deny-by-default policy before it reaches your data — with no LLM in the decision path.
The complete guides for the current release are published at admin.tiresias.network, user.tiresias.network, and quickstart.tiresias.network. Administer your deployment from the admin portal.
What it does
Tiresias-ZT governs agent access at the request layer:
- Deny-by-default policy decisions on every memory / MCP request
- Bring your own backend — your data never leaves your store
- SoulKey-signed, tamper-evident audit trail (hybrid Ed25519 + post-quantum ML-DSA)
- Optional server-side encrypted transcript retention — per-tenant keys with crypto-shred erasure, kept separate from the content-blind audit trail
- SoulWatch behavioral anomaly detection with automated quarantine
- Capability-token introspection on agent requests
- Usage metering with a cost / budget governor
- Sovereignty-gated reads of memory and chain-of-thought — never-cloud content never leaves a cloud instance
- RBAC hierarchy (Platform → MSSP → Tenant → Agent) with OIDC SSO
How it deploys
The proxy is MCP-native and container-first. It runs inside your infrastructure in front of the memory or MCP backend you already operate, and is administered from the hosted portal at cp.tiresias.network.