Viktor.comAn AI coworker that actually does the work
Phinq
Stops AI agents before they break something
68 followers
Stops AI agents before they break something
68 followers
Phinq is an open source runtime governance layer for AI agents. It intercepts every agent tool call, classifies it by risk, lets safe actions pass, holds irreversible actions for human approval, and records each decision in a tamper-evident hash-chained audit log.
Phinq
"Nobody was asking the harder question: what should agents actually be allowed to do" is a better problem statement than most funded companies in this space have written down.
Classify by risk is the load-bearing step and it is where the pressure will land. delete_file is not a risk level, it is a verb. The same call is trivial on a temp artefact and unrecoverable on the only copy of something, and that difference lives in the argument and in the state of the world. Neither is carried by the tool name. So the classifier ends up guessing reversibility without knowing what is being acted on.
Can a Phinq rule read the arguments, or does it decide on the signature? And can an operator declare "this path is precious" so the answer comes from a human rather than a model?
Phinq
@rabnoor_s this is the right question and I’m glad you asked.
delete_file on a temp cache and delete_file on the only production backup are not the same risk. but the classifier sees the same verb.
right now phinq goes by tool name first. a named delete tool gets flagged irreversible before anything else. it's the cautious default.
shell surfaces are different. raw rm -rf / and DROP TABLE through bash do get argument inspection. but that path is conservative right now. it flags but mostly allows. sql through a shell is harder to classify correctly than a named tool.
the thing you're asking about. declaring "this path is precious" doesn't exist in the proxy yet. it's the obvious direction. phinq learn is the vector. once it's seen you deny rm on /home/prod but allow it on /tmp/build, it starts inferring the boundary.
you're pointing at the hard part. "classify by risk" only works if the classifier sees more than the verb. state of the argument and state of the world are where the actual risk lives.
what would a 'precious path' rule look like in a config file that you'd trust?
The idea of holding irreversible actions for human approval is really smart, adds a layer of safety to AI agent interactions.
Phinq
@aymnart Appreciate that, means a lot.
That's the whole point of phinq. Agents should be able to do the work without the risk. No one wants to wake up to everything deleted or an overboard credit bill, especially as LLMs get smarter and do their own thing.
For you personally, what would you never let an agent touch unsupervised?