Phinq 是面向 AI 智能体的运行时治理层，拦截工具调用、风险分级并需人工审批，保障安全并记录审计日志。
热门评论
PH 用户
I built Phinq because I watched an agent overwrite something it shouldn't have touched.
I'm 21, a fresh graduate in London, and after graduating I couldn't find a job. So I went deep on the AI builder side. Tinkering. Learning. Trying to find my way in.
Everyone was racing to make agents smarter. Then I watched an agent overwrite something it had no business touching, and it clicked. Nobody was asking the harder question. What should agents actually be allowed to do?
This isn't hypothetical. In April, a coding agent deleted a company's entire production database and all its backups in nine seconds. Another wiped 1,206 executives' records during a freeze its user had explicitly declared. These are already happening to real teams.
Phinq is the answer. An open source layer that sits between an agent and the world. Before an action happens, it decides how risky it is. Reversible things pass through. Irreversible things pause and ping your phone. It checks the action against the rules you set, then writes a tamper-evident audit log of everything.
On our own stats page: 9,031 decisions classified, 323 held, 50 denied, 116 safeguard-disable attempts. And counting.
Agents don't need more power. They need a bouncer.
And the clock is running. The EU AI Act started enforcing human oversight 10 days ago. This isn't the nice-to-have layer anymore. It's becoming the required one.
It's open source (MIT), and it works with OpenAI, Anthropic, LangChain, CrewAI, AutoGen, and anything that speaks those APIs. Either a governance proxy, or a lightweight skill you drop straight into Claude Code, Codex, and OpenCode.
I couldn't find a job, so I built one. In public.
If you think agents need guardrails, the upvote means a lot. Happy to answer anything in the comments.
PH 用户
"Nobody was asking the harder question: what should agents actually be allowed to do" is a better problem statement than most funded companies in this space have written down.
Classify by risk is the load-bearing step and it is where the pressure will land. delete_file is not a risk level, it is a verb. The same call is trivial on a temp artefact and unrecoverable on the only copy of something, and that difference lives in the argument and in the state of the world. Neither is carried by the tool name. So the classifier ends up guessing reversibility without knowing what is being acted on.
Can a Phinq rule read the arguments, or does it decide on the signature? And can an operator declare "this path is precious" so the answer comes from a human rather than a model?
PH 用户
Do you distinguish a tool being unavailable from a tool returning a wrong answer? At the call site they look identical, but they want opposite handling: the first is worth a retry, the second gets worse every time you retry it. I hit this with an upstream that returns a cheerful 200 with an empty body when it's actually down — the only fix was to stop trusting the transport and validate the payload shape.
PH 用户
The idea of holding irreversible actions for human approval is really smart, adds a layer of safety to AI agent interactions.
I'm 21, a fresh graduate in London, and after graduating I couldn't find a job. So I went deep on the AI builder side. Tinkering. Learning. Trying to find my way in.
Everyone was racing to make agents smarter. Then I watched an agent overwrite something it had no business touching, and it clicked. Nobody was asking the harder question. What should agents actually be allowed to do?
This isn't hypothetical. In April, a coding agent deleted a company's entire production database and all its backups in nine seconds. Another wiped 1,206 executives' records during a freeze its user had explicitly declared. These are already happening to real teams.
Phinq is the answer. An open source layer that sits between an agent and the world. Before an action happens, it decides how risky it is. Reversible things pass through. Irreversible things pause and ping your phone. It checks the action against the rules you set, then writes a tamper-evident audit log of everything.
On our own stats page: 9,031 decisions classified, 323 held, 50 denied, 116 safeguard-disable attempts. And counting.
Agents don't need more power. They need a bouncer.
And the clock is running. The EU AI Act started enforcing human oversight 10 days ago. This isn't the nice-to-have layer anymore. It's becoming the required one.
It's open source (MIT), and it works with OpenAI, Anthropic, LangChain, CrewAI, AutoGen, and anything that speaks those APIs. Either a governance proxy, or a lightweight skill you drop straight into Claude Code, Codex, and OpenCode.
I couldn't find a job, so I built one. In public.
If you think agents need guardrails, the upvote means a lot. Happy to answer anything in the comments.
Classify by risk is the load-bearing step and it is where the pressure will land. delete_file is not a risk level, it is a verb. The same call is trivial on a temp artefact and unrecoverable on the only copy of something, and that difference lives in the argument and in the state of the world. Neither is carried by the tool name. So the classifier ends up guessing reversibility without knowing what is being acted on.
Can a Phinq rule read the arguments, or does it decide on the signature? And can an operator declare "this path is precious" so the answer comes from a human rather than a model?