Technical Deep Dive

The full Quint story in one page — from problem to architecture to detection to what’s real. Start here, drill down anywhere.

The accountability engine for AI Agents

AI agents ship to production with zero security telemetry. They execute processes, read files, make network calls, hold credentials — and nobody is watching. Quint changes that.

This page tells the full story in one scroll. Each section links to the detailed reference page if you want to go deeper.

---

1. The Problem

Every major AI coding agent — Claude Code, Cursor, Copilot, Windsurf, Cline — runs with the same privileges as the developer using it. Full filesystem. Full network. Full process execution. No audit trail.

Traditional security tools don’t see agent actions. EDR sees processes but can’t attribute them to an agent session. CASB sees network traffic but can’t tie it to a tool call. SIEM gets logs but has no concept of an agent’s declared intent versus its actual behavior.

The result: shadow AI agents proliferate with zero visibility, and the enterprise has no answer to the question “what are our AI agents actually doing?“

---

2. The Insight: Intent vs. Truth

Quint sits in two data paths simultaneously on the same machine:

Intent Stream

The Forward Proxy intercepts every LLM API response and extracts tool_use blocks — what the agent says it will do. 7 protocol parsers: Anthropic, OpenAI Chat, OpenAI Responses, Gemini, Bedrock, Azure, generic.

Truth Stream

Endpoint Security observes the kernel — every process spawn, file read/write, and network connection the OS actually performs. Filtered to the agent’s process tree.

Both streams share a deterministic session ID derived from the agent’s root process. The daemon merges them on the machine, before events leave. Correlation is primarily by the process (PID) tree — a time window is only a fallback, because Claude Code fires ~12K exec events/sec during a build and a pure time-window join would cross-talk. The cloud runs a 5-minute cross-session pass on top.

The six divergence types

Type	Signal	Severity
Truth without intent	OS saw an action the model never declared	High — canonical prompt injection signal
Target mismatch	Intent said config.yml, truth saw /etc/passwd	Critical — path traversal, symlink exploit
Scale mismatch	Intent: read one file. Truth: 847 reads across /src/**	High — data exfiltration
Timing anomaly	Intent at T=0, truth at T=45s	Medium — stored/replayed execution
Truth precedes intent	OS action happened before the model declared it	Critical — credential harvesting, hijacking
Intent without truth	Model declared an action the OS never saw	Low — usually a telemetry gap

Products that only see intent can’t detect truth-without-intent. Products that only see truth can’t detect target mismatch. Quint sees both.

Go Deeper: Intent vs. Truth

The full specification: both streams, the join algorithm, all six divergence types with examples, and why the two-stream architecture is defensible.

---

3. Follow One Tool Call

A user types a prompt in Claude Code. Here’s what happens:

1. Agent sends request

   Claude Code sends a streaming POST to bedrock-runtime.us-east-1.amazonaws.com.

2. Interception

   The macOS Network Extension recognizes the Bedrock hostname and relays the flow to the daemon. On other OSes, HTTPS_PROXY routes it through the forward proxy.

3. MITM TLS + parse

   The daemon presents a leaf cert signed by the local Quint CA. llmparse detects Bedrock eventstream format, extracts the model, tools, and messages.

4. Session stamped

   The daemon looks up the source PID in unisession.Tracker. Every audit row gets session_id = "{rootPID}-{startUnixMs}".

5. Tool call extracted

   When the response produces a tool_use block (e.g., Bash({"command":"ls"})), the parser extracts it and fires OnToolCall.

6. Local audit

   The tool call is persisted to the signed audit log (quint.db). Each row is Ed25519-signed and chained via prev_hash.

7. Cloud forward

   A structured QuintEvent is enqueued in the cloud forwarder (batched 500 events / 1s flush, retries 5x with backoff, overflows to disk).

8. Ingest + scoring

   api.quintai.dev/v1/ingest stamps org_id, publishes to SNS FIFO, fans out to SQS. The scoring service runs the 4-gate behavioral pipeline.

9. Dashboard

   The score lands in Postgres, SSE pushes it to the Sessions view. If a rule triggered block, the next identical action is rejected at the edge.

Go Deeper: End-to-End Flow

The full 12-step trace with architecture diagrams, design principles, and data flow details.

---

4. How Detection Works

Shadow-only, superseded (2026-07-18). The agent fingerprint, 4-gate pipeline, confidence bands, and flow matrices in this section are the pre-pivot behavioral layer — shadow-only scaffolding that makes no enforcement decision. Current detection compiles the agent’s stated intent into a scope and enforces it deterministically (Gate 0.5); see Intent vs Truth. This section is retained as background on the behavioral substrate that still runs in shadow.

The Agent Fingerprint (~3.1KB)

Every agent builds a probabilistic behavioral fingerprint — a fixed-size statistical summary that captures what the agent normally does without storing raw history.

Component	Structure	What It Answers
Capability distribution	[12]float32	What does this agent normally do?
Tool frequency	Count-Min Sketch (2KB)	How often does it use each tool?
Novelty detection	3 Bloom filters (320B)	Has it EVER used this tool/server/domain?
Temporal profile	EWMA + Welford	When is this agent active? What’s normal timing?
Sequence model	32-slot Markov chain	What action sequences are normal?
Cardinality	3 HyperLogLog sketches	How diverse is this agent’s behavior?

Memory: ~3,100 bytes per agent. 40K concurrent agents in 128MB. Update is O(1), ~186ns per action.

The 4-Gate Pipeline

A fast-rejection architecture — each gate is cheaper than the next, and 95% of actions exit at Gate 1.

Gate	Latency	What It Does	Exit Rate
0: Deny List	~200ns	Hash lookup, capability policy, rate limit	~0.1% blocked
1: Envelope	~114ns, 0 allocs	Bloom (tool novelty) + CMS (frequency) + JSD (capability drift). All pass → KNOWN_SAFE	~95% exit
2: Deviation	~433ns	6 independent signals: novelty, frequency spike, capability shift, temporal anomaly, sequence anomaly, exploration spike	~4% UNCERTAIN
3: Corroboration	~293ns	3+ signals must corroborate + session trajectory + structural evidence	<0.5% ANOMALOUS

The noise budget: 95% of actions produce zero output — not a low score, literally nothing. Operators only see the <0.5% that reach ANOMALOUS.

Confidence Bands

The behavioral engine does not produce per-action risk scores. It classifies every action into one of three bands:

Band	% of Actions	Response	User Sees
KNOWN_SAFE	95-97%	Zero output. No score. No log.	Nothing
UNCERTAIN	3-4.5%	Telemetry counter only	Nothing
ANOMALOUS	<0.5%	Corroborating signal only (no enforcement)	Nothing — shadow-only

Three bands solve alert fatigue. Operators only see Band 3 sessions.

Flow Matrices + Threat Signatures

The fingerprint tracks capability-to-capability transitions as a 12x12 flow matrix. Threat signatures are structural shapes matched via Jensen-Shannon Divergence — not hardcoded tool combinations.

A signature is NOT “if read_file then curl = exfiltration.” A signature IS “the flow matrix has 80%+ mass in the read→outbound quadrant.” This catches any tool combination that produces that shape.

5 built-in signatures: Exfiltration, Credential Relay, Staging + Execution, Reconnaissance, Cover Tracks.

Envelope Lifecycle

Fingerprints are alive — they evolve as agent behavior changes:

Phase	Actions	Behavior
Cold Start	0-10	Gates pass through without scoring. Group envelope provides borrowed baseline.
Learning	10-100	Gates active. Gate 1 starts short-circuiting known tools. Novel tools evaluated.
Mature	100+	Fingerprint trusted. 95% fast path in ~526ns.
Evolution	Ongoing	EWMA decay fades old patterns. New behavior becomes baseline over ~140 actions.
Drift Detection	Hourly	Frozen 7-day snapshot compared via JSD. “Boiling frog” detection.
Multi-Proxy Sync	30s flush	Delta-merged into Redis. Hydrate on cache miss. Bootstrap on startup.

---

5. The Detection Ladder

Quint’s detection architecture is a five-stage ladder. Each stage depends on data the previous stage produced. Skipping rungs produces detection that either fires on everything or misses real attacks.

Stage	Method	Data Required	Status
0: Rules	Deterministic pattern matching	None	Live
1: Fingerprints	Probabilistic per-agent baselines	~100 actions/agent	Shadow mode
2: LLM Triage	Claude Haiku classifies ambiguous events	None (bootstraps labels)	Roadmap
3: Supervised	XGBoost on labeled feature vectors	~50K labeled events	Roadmap
4: Graph Models	Re-aimed GNN over intent-annotated provenance graphs (global tier)	Real, analyst-confirmed divergence labels	After Phase 2

This ladder describes the pre-pivot behavioral progression and is superseded by Intent-Scoped Security; the earlier per-action flow-matrix/GNN closed loop is retired. The re-aimed GNN (Stage 4) is a global-tier, offline model — unjustified activity is a subgraph with no path to a goal node — not an edge scorer, and it never makes an enforcement decision. See ML Ladder for the full, superseded detail.

The learning loop: confirmed local determinations feed a federated distillation loop — models ship to the data, only geometry ships back. The cloud pushes down signed, versioned artifacts (intent-model weights, exemplar embeddings, workflow priors, scope templates); enforcement stays deterministic and local.

Precedent: CrowdStrike, SentinelOne, and Abnormal Security all followed the same sequence — behavioral rules first, ML later. Shipping a graph model on insufficient data overfits and fails in production, which is why the re-aimed GNN is sequenced only after real divergence labels exist.

Go Deeper: Detection Ladder

Stage-by-stage justification with academic references (Grinsztajn NeurIPS 2022, TGN, E-GraphSAGE), data threshold analysis, and advancement triggers.

---

6. Three-Tier Architecture

Design principles

1. Local-first capture, cloud-first scoring. Raw bodies stay on the machine. Normalized events flow to the cloud.
2. Lossy at the edge, durable in the cloud. Under backpressure, the edge drops events rather than block user traffic.
3. Zero client changes. Forward proxy + NE means no SDK integration, no new endpoints.
4. Session-centric model. Everything anchors to sessions, not raw events.
5. Code signing first. Agent detection uses macOS code signing as the highest-confidence signal.
6. Tenant isolation at every layer. Deploy tokens scoped to orgs. Postgres RLS. FIFO queues keyed by session.

What stays on the machine vs. goes to cloud

Stays local	Goes to cloud
Source code, credentials, API keys	Structured action metadata
Full LLM conversation bodies	Agent identity + platform
Tool input arguments (raw)	Tool name + capability + risk score
CA private key + Ed25519 signing key	Timestamps + session IDs

Go Deeper: System Design

Full deployment topology, security properties, resource footprints.

Go Deeper: Edge Architecture

How the daemon, proxy, ES, and NE fit together on one machine.

---

7. Platform Coverage

Quint is one behavioral intelligence engine fed by platform-specific collectors that all produce the same QuintEvent envelope. Adding a platform means adding a collector, not rebuilding the product.

Category	Collector	Status
macOS desktop	Go daemon + Swift ES + Swift NE	Live
Windows desktop	Go daemon + WFP + ETW	Planned (12-16 weeks)
Linux desktop	Go daemon + eBPF + iptables	Planned (8-12 weeks, unlocks K8s + CI/CD)
Kubernetes	Sidecar proxy + eBPF DaemonSet + Helm	Designed
Browser	Chrome/Edge extension	Designed
CI/CD	GitHub Action wrapper	Designed (depends on Linux)

The architectural constraint that makes this possible: no top-level QuintEvent field is platform-specific. Detection logic, model training data, and dashboard views are identical across every collector. Data compounds across platforms because the schema is one schema.

Go Deeper: Platform Coverage

The source-agnostic architecture, all five deployment categories (desktop, browser, cloud, CI/CD, SaaS), and the decision framework for new platforms.

---

8. What’s Real

Layer	Maturity	Evidence
Edge daemon	Late alpha	20,900 LOC Go. 150 test files. 19 agent platforms. 7 LLM parsers. Full 4-gate pipeline with real algorithms.
Cloud platform	Early alpha	Production-grade ingest. Batched writes with per-row SAVEPOINTs. RLS enforced on every table. 3,481 events flowed laptop-to-Postgres without loss.
Behavioral scoring	Shadow mode (superseded)	Full gate pipeline computes on every event as shadow-only scaffolding; it makes no enforcement decision.
Dashboard	Pre-alpha	Sessions list ~80% functional. Session detail ~70%. Everything else placeholder.
Intent-scope enforcement	Spine live (M0)	Deterministic compile-and-check (M0 lexicon + Gate 0.5) is the current enforcement path; QIM v1 and the re-aimed GNN are phased.

The honest one-paragraph description

Quint is a working edge daemon for macOS that intercepts AI agent LLM traffic, observes agent behavior through Endpoint Security and Network Extension, compiles each turn’s stated intent into an enforceable scope and checks every tool call against it deterministically in microseconds (with a per-agent behavioral layer running in shadow), and streams events to a cloud pipeline with proper multi-tenant isolation. The two layers that make the pitch most compelling — intent-vs-truth divergence detection and the fleet-trained intent model (QIM) — are specified, designed, and partially implemented, with the architectural foundations proven. What’s built is genuinely well-engineered. What’s ahead is a data problem, not an architecture problem.

---

Tech Stack

Component	Technology
Endpoint Agent	Go daemon, Endpoint Security (macOS), eBPF (Linux planned)
Streaming	NATS JetStream
Cloud API	Go (stdlib net/http, pgx/v5)
Database	PostgreSQL (RDS) with Row-Level Security
Auth	Supabase (JWT) + Deploy Tokens (SHA-256 hashed)
Dashboard	Next.js on Vercel (shadcn/ui)
Infra	Terraform, AWS ECS Fargate

---

Interactive Architecture Demo

Animated, interactive visualization of the full architecture — flow matrices, behavioral envelopes, scoring pipeline particles, intent-vs-truth correlation, and threat signature matching. Built for live walkthroughs.