> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Technical Deep Dive

> The full Quint story in one page — from problem to architecture to detection to what's real. Start here, drill down anywhere.

# The accountability engine for AI Agents

AI agents ship to production with zero security telemetry. They execute processes, read files, make network calls, hold credentials — and nobody is watching. Quint changes that.

<Info>
  This page tells the full story in one scroll. Each section links to the detailed reference page if you want to go deeper.
</Info>

***

## 1. The Problem

Every major AI coding agent — Claude Code, Cursor, Copilot, Windsurf, Cline — runs with the same privileges as the developer using it. Full filesystem. Full network. Full process execution. No audit trail.

Traditional security tools don't see agent actions. EDR sees processes but can't attribute them to an agent session. CASB sees network traffic but can't tie it to a tool call. SIEM gets logs but has no concept of an agent's declared intent versus its actual behavior.

The result: shadow AI agents proliferate with zero visibility, and the enterprise has no answer to the question *"what are our AI agents actually doing?"*

<StatRow
  stats={[
{ value: "65%", label: "of enterprises have suffered an AI agent security incident", source: "CLOUD SECURITY ALLIANCE · APRIL 2026" },
{ value: "75%+", label: "of employees will use AI tools IT hasn't provisioned by 2027", source: "GARTNER · 2025" },
{ value: "80%", label: "of orgs have no process for decommissioning AI agents", source: "CSA · APRIL 2026" }
]}
/>

***

## 2. The Insight: Intent vs. Truth

Quint sits in two data paths simultaneously on the same machine:

<CardGroup cols={2}>
  <Card title="Intent Stream" icon="message-lines">
    **The Forward Proxy** intercepts every LLM API response and extracts `tool_use` blocks — what the agent **says** it will do. 7 protocol parsers: Anthropic, OpenAI Chat, OpenAI Responses, Gemini, Bedrock, Azure, generic.
  </Card>

  <Card title="Truth Stream" icon="microchip">
    **Endpoint Security** observes the kernel — every process spawn, file read/write, and network connection the OS **actually** performs. Filtered to the agent's process tree.
  </Card>
</CardGroup>

Both streams share a deterministic session ID derived from the agent's root process. The daemon merges them **on the machine**, before events leave. Correlation is **primarily by the process (PID) tree** — a time window is only a fallback, because Claude Code fires \~12K exec events/sec during a build and a pure time-window join would cross-talk. The cloud runs a 5-minute cross-session pass on top.

### The six divergence types

| Type                      | Signal                                                   | Severity                                    |
| ------------------------- | -------------------------------------------------------- | ------------------------------------------- |
| **Truth without intent**  | OS saw an action the model never declared                | High — canonical prompt injection signal    |
| **Target mismatch**       | Intent said `config.yml`, truth saw `/etc/passwd`        | Critical — path traversal, symlink exploit  |
| **Scale mismatch**        | Intent: read one file. Truth: 847 reads across `/src/**` | High — data exfiltration                    |
| **Timing anomaly**        | Intent at T=0, truth at T=45s                            | Medium — stored/replayed execution          |
| **Truth precedes intent** | OS action happened before the model declared it          | Critical — credential harvesting, hijacking |
| **Intent without truth**  | Model declared an action the OS never saw                | Low — usually a telemetry gap               |

**Products that only see intent can't detect truth-without-intent. Products that only see truth can't detect target mismatch. Quint sees both.**

<Card title="Go Deeper: Intent vs. Truth" icon="arrow-right" href="/concepts/intent-vs-truth">
  The full specification: both streams, the join algorithm, all six divergence types with examples, and why the two-stream architecture is defensible.
</Card>

***

## 3. Follow One Tool Call

A user types a prompt in Claude Code. Here's what happens:

<Steps>
  <Step title="Agent sends request">
    Claude Code sends a streaming POST to `bedrock-runtime.us-east-1.amazonaws.com`.
  </Step>

  <Step title="Interception">
    The macOS Network Extension recognizes the Bedrock hostname and relays the flow to the daemon. On other OSes, `HTTPS_PROXY` routes it through the forward proxy.
  </Step>

  <Step title="MITM TLS + parse">
    The daemon presents a leaf cert signed by the local Quint CA. `llmparse` detects Bedrock eventstream format, extracts the model, tools, and messages.
  </Step>

  <Step title="Session stamped">
    The daemon looks up the source PID in `unisession.Tracker`. Every audit row gets `session_id = "{rootPID}-{startUnixMs}"`.
  </Step>

  <Step title="Tool call extracted">
    When the response produces a `tool_use` block (e.g., `Bash({"command":"ls"})`), the parser extracts it and fires `OnToolCall`.
  </Step>

  <Step title="Local audit">
    The tool call is persisted to the signed audit log (`quint.db`). Each row is Ed25519-signed and chained via `prev_hash`.
  </Step>

  <Step title="Cloud forward">
    A structured `QuintEvent` is enqueued in the cloud forwarder (batched 500 events / 1s flush, retries 5x with backoff, overflows to disk).
  </Step>

  <Step title="Ingest + scoring">
    `api.quintai.dev/v1/ingest` stamps `org_id`, publishes to SNS FIFO, fans out to SQS. The scoring service runs the 4-gate behavioral pipeline.
  </Step>

  <Step title="Dashboard">
    The score lands in Postgres, SSE pushes it to the Sessions view. If a rule triggered `block`, the next identical action is rejected at the edge.
  </Step>
</Steps>

<Card title="Go Deeper: End-to-End Flow" icon="arrow-right" href="/concepts/how-it-works">
  The full 12-step trace with architecture diagrams, design principles, and data flow details.
</Card>

***

## 4. How Detection Works

<Warning>
  **Shadow-only, superseded (2026-07-18).** The agent fingerprint, 4-gate pipeline, confidence bands, and flow matrices in this section are the pre-pivot behavioral layer — shadow-only scaffolding that makes **no enforcement decision**. Current detection compiles the agent's stated intent into a scope and enforces it deterministically (Gate 0.5); see [Intent vs Truth](/concepts/intent-vs-truth). This section is retained as background on the behavioral substrate that still runs in shadow.
</Warning>

### The Agent Fingerprint (\~3.1KB)

Every agent builds a probabilistic behavioral fingerprint — a fixed-size statistical summary that captures what the agent normally does without storing raw history.

| Component               | Structure              | What It Answers                                  |
| ----------------------- | ---------------------- | ------------------------------------------------ |
| Capability distribution | `[12]float32`          | What does this agent normally do?                |
| Tool frequency          | Count-Min Sketch (2KB) | How often does it use each tool?                 |
| Novelty detection       | 3 Bloom filters (320B) | Has it EVER used this tool/server/domain?        |
| Temporal profile        | EWMA + Welford         | When is this agent active? What's normal timing? |
| Sequence model          | 32-slot Markov chain   | What action sequences are normal?                |
| Cardinality             | 3 HyperLogLog sketches | How diverse is this agent's behavior?            |

**Memory:** \~3,100 bytes per agent. 40K concurrent agents in 128MB. Update is O(1), \~186ns per action.

### The 4-Gate Pipeline

A fast-rejection architecture — each gate is cheaper than the next, and 95% of actions exit at Gate 1.

| Gate                 | Latency           | What It Does                                                                                                             | Exit Rate        |
| -------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------- |
| **0: Deny List**     | \~200ns           | Hash lookup, capability policy, rate limit                                                                               | \~0.1% blocked   |
| **1: Envelope**      | \~114ns, 0 allocs | Bloom (tool novelty) + CMS (frequency) + JSD (capability drift). All pass → KNOWN\_SAFE                                  | **\~95% exit**   |
| **2: Deviation**     | \~433ns           | 6 independent signals: novelty, frequency spike, capability shift, temporal anomaly, sequence anomaly, exploration spike | \~4% UNCERTAIN   |
| **3: Corroboration** | \~293ns           | 3+ signals must corroborate + session trajectory + structural evidence                                                   | \<0.5% ANOMALOUS |

**The noise budget:** 95% of actions produce zero output — not a low score, literally nothing. Operators only see the \<0.5% that reach ANOMALOUS.

<CardGroup cols={2} />

### Confidence Bands

The behavioral engine does not produce per-action risk scores. It classifies every action into one of three bands:

| Band            | % of Actions | Response                                   | User Sees             |
| --------------- | ------------ | ------------------------------------------ | --------------------- |
| **KNOWN\_SAFE** | 95-97%       | Zero output. No score. No log.             | Nothing               |
| **UNCERTAIN**   | 3-4.5%       | Telemetry counter only                     | Nothing               |
| **ANOMALOUS**   | \<0.5%       | Corroborating signal only (no enforcement) | Nothing — shadow-only |

Three bands solve alert fatigue. Operators only see Band 3 sessions.

### Flow Matrices + Threat Signatures

The fingerprint tracks capability-to-capability transitions as a 12x12 flow matrix. Threat signatures are structural shapes matched via Jensen-Shannon Divergence — not hardcoded tool combinations.

A signature is NOT "if `read_file` then `curl` = exfiltration." A signature IS "the flow matrix has 80%+ mass in the read→outbound quadrant." This catches any tool combination that produces that shape.

5 built-in signatures: Exfiltration, Credential Relay, Staging + Execution, Reconnaissance, Cover Tracks.

### Envelope Lifecycle

Fingerprints are alive — they evolve as agent behavior changes:

| Phase                | Actions   | Behavior                                                                         |
| -------------------- | --------- | -------------------------------------------------------------------------------- |
| **Cold Start**       | 0-10      | Gates pass through without scoring. Group envelope provides borrowed baseline.   |
| **Learning**         | 10-100    | Gates active. Gate 1 starts short-circuiting known tools. Novel tools evaluated. |
| **Mature**           | 100+      | Fingerprint trusted. 95% fast path in \~526ns.                                   |
| **Evolution**        | Ongoing   | EWMA decay fades old patterns. New behavior becomes baseline over \~140 actions. |
| **Drift Detection**  | Hourly    | Frozen 7-day snapshot compared via JSD. "Boiling frog" detection.                |
| **Multi-Proxy Sync** | 30s flush | Delta-merged into Redis. Hydrate on cache miss. Bootstrap on startup.            |

***

## 5. The Detection Ladder

Quint's detection architecture is a five-stage ladder. Each stage depends on data the previous stage produced. Skipping rungs produces detection that either fires on everything or misses real attacks.

| Stage               | Method                                                             | Data Required                             | Status          |
| ------------------- | ------------------------------------------------------------------ | ----------------------------------------- | --------------- |
| **0: Rules**        | Deterministic pattern matching                                     | None                                      | **Live**        |
| **1: Fingerprints** | Probabilistic per-agent baselines                                  | \~100 actions/agent                       | **Shadow mode** |
| **2: LLM Triage**   | Claude Haiku classifies ambiguous events                           | None (bootstraps labels)                  | Roadmap         |
| **3: Supervised**   | XGBoost on labeled feature vectors                                 | \~50K labeled events                      | Roadmap         |
| **4: Graph Models** | Re-aimed GNN over intent-annotated provenance graphs (global tier) | Real, analyst-confirmed divergence labels | After Phase 2   |

<Info>
  This ladder describes the pre-pivot behavioral progression and is superseded by [Intent-Scoped Security](/concepts/intent-vs-truth); the earlier per-action flow-matrix/GNN closed loop is retired. The re-aimed GNN (Stage 4) is a global-tier, offline model — *unjustified activity is a subgraph with no path to a goal node* — not an edge scorer, and it never makes an enforcement decision. See [ML Ladder](/concepts/ml-ladder) for the full, superseded detail.
</Info>

**The learning loop:** confirmed local determinations feed a federated distillation loop — *models ship to the data, only geometry ships back*. The cloud pushes down signed, versioned artifacts (intent-model weights, exemplar embeddings, workflow priors, scope templates); enforcement stays deterministic and local.

**Precedent:** CrowdStrike, SentinelOne, and Abnormal Security all followed the same sequence — behavioral rules first, ML later. Shipping a graph model on insufficient data overfits and fails in production, which is why the re-aimed GNN is sequenced only after real divergence labels exist.

<Card title="Go Deeper: Detection Ladder" icon="arrow-right" href="/concepts/ml-ladder">
  Stage-by-stage justification with academic references (Grinsztajn NeurIPS 2022, TGN, E-GraphSAGE), data threshold analysis, and advancement triggers.
</Card>

***

## 6. Three-Tier Architecture

```mermaid theme={null}
flowchart TD
    subgraph T1["Tier 1: Edge (macOS pkg)"]
        ES["Endpoint Security (Swift)"]
        NE["Network Extension (Swift)"]
        Daemon["Go Daemon (proxy, sessions, forwarder)"]
        Audit["Signed Audit Log (SQLite, Ed25519)"]
        ES --> Daemon
        NE --> Daemon
        Daemon --> Audit
    end

    subgraph T2["Tier 2: Cloud (AWS ECS Fargate)"]
        Ingest["Ingest Service"]
        Pipeline["Pipeline + Session + Alert Processors"]
        DB[("PostgreSQL (RLS, monthly partitions)")]
        API["API Service"]
        Ingest --> Pipeline --> DB --> API
    end

    subgraph T3["Tier 3: Dashboard (Vercel)"]
        UI["Next.js (session-centric views)"]
    end

    Daemon -->|"HTTPS batch"| Ingest
    API --> UI

    style T1 fill:#1a1a2e,stroke:#FF3C22,stroke-width:2px
    style T2 fill:#1a1a2e,stroke:#58a6ff,stroke-width:2px
    style T3 fill:#1a1a2e,stroke:#a371f7,stroke-width:2px
```

### Design principles

1. **Local-first capture, cloud-first scoring.** Raw bodies stay on the machine. Normalized events flow to the cloud.
2. **Lossy at the edge, durable in the cloud.** Under backpressure, the edge drops events rather than block user traffic.
3. **Zero client changes.** Forward proxy + NE means no SDK integration, no new endpoints.
4. **Session-centric model.** Everything anchors to sessions, not raw events.
5. **Code signing first.** Agent detection uses macOS code signing as the highest-confidence signal.
6. **Tenant isolation at every layer.** Deploy tokens scoped to orgs. Postgres RLS. FIFO queues keyed by session.

### What stays on the machine vs. goes to cloud

| Stays local                          | Goes to cloud                       |
| ------------------------------------ | ----------------------------------- |
| Source code, credentials, API keys   | Structured action metadata          |
| Full LLM conversation bodies         | Agent identity + platform           |
| Tool input arguments (raw)           | Tool name + capability + risk score |
| CA private key + Ed25519 signing key | Timestamps + session IDs            |

<CardGroup cols={2}>
  <Card title="Go Deeper: System Design" icon="arrow-right" href="/concepts/system-design">
    Full deployment topology, security properties, resource footprints.
  </Card>

  <Card title="Go Deeper: Edge Architecture" icon="arrow-right" href="/edge/overview">
    How the daemon, proxy, ES, and NE fit together on one machine.
  </Card>
</CardGroup>

***

## 7. Platform Coverage

Quint is one behavioral intelligence engine fed by platform-specific collectors that all produce the same `QuintEvent` envelope. Adding a platform means adding a collector, not rebuilding the product.

| Category          | Collector                             | Status                                    |
| ----------------- | ------------------------------------- | ----------------------------------------- |
| **macOS desktop** | Go daemon + Swift ES + Swift NE       | **Live**                                  |
| Windows desktop   | Go daemon + WFP + ETW                 | Planned (12-16 weeks)                     |
| Linux desktop     | Go daemon + eBPF + iptables           | Planned (8-12 weeks, unlocks K8s + CI/CD) |
| Kubernetes        | Sidecar proxy + eBPF DaemonSet + Helm | Designed                                  |
| Browser           | Chrome/Edge extension                 | Designed                                  |
| CI/CD             | GitHub Action wrapper                 | Designed (depends on Linux)               |

**The architectural constraint that makes this possible:** no top-level `QuintEvent` field is platform-specific. Detection logic, model training data, and dashboard views are identical across every collector. Data compounds across platforms because the schema is one schema.

<Card title="Go Deeper: Platform Coverage" icon="arrow-right" href="/concepts/platform-coverage">
  The source-agnostic architecture, all five deployment categories (desktop, browser, cloud, CI/CD, SaaS), and the decision framework for new platforms.
</Card>

***

## 8. What's Real

| Layer                        | Maturity                 | Evidence                                                                                                                                           |
| ---------------------------- | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Edge daemon**              | Late alpha               | 20,900 LOC Go. 150 test files. 19 agent platforms. 7 LLM parsers. Full 4-gate pipeline with real algorithms.                                       |
| **Cloud platform**           | Early alpha              | Production-grade ingest. Batched writes with per-row SAVEPOINTs. RLS enforced on every table. 3,481 events flowed laptop-to-Postgres without loss. |
| **Behavioral scoring**       | Shadow mode (superseded) | Full gate pipeline computes on every event as shadow-only scaffolding; it makes no enforcement decision.                                           |
| **Dashboard**                | Pre-alpha                | Sessions list \~80% functional. Session detail \~70%. Everything else placeholder.                                                                 |
| **Intent-scope enforcement** | Spine live (M0)          | Deterministic compile-and-check (M0 lexicon + Gate 0.5) is the current enforcement path; QIM v1 and the re-aimed GNN are phased.                   |

### The honest one-paragraph description

Quint is a working edge daemon for macOS that intercepts AI agent LLM traffic, observes agent behavior through Endpoint Security and Network Extension, compiles each turn's stated intent into an enforceable scope and checks every tool call against it deterministically in microseconds (with a per-agent behavioral layer running in shadow), and streams events to a cloud pipeline with proper multi-tenant isolation. The two layers that make the pitch most compelling — intent-vs-truth divergence detection and the fleet-trained intent model (QIM) — are specified, designed, and partially implemented, with the architectural foundations proven. What's built is genuinely well-engineered. What's ahead is a data problem, not an architecture problem.

***

## Tech Stack

| Component      | Technology                                                 |
| -------------- | ---------------------------------------------------------- |
| Endpoint Agent | Go daemon, Endpoint Security (macOS), eBPF (Linux planned) |
| Streaming      | NATS JetStream                                             |
| Cloud API      | Go (stdlib net/http, pgx/v5)                               |
| Database       | PostgreSQL (RDS) with Row-Level Security                   |
| Auth           | Supabase (JWT) + Deploy Tokens (SHA-256 hashed)            |
| Dashboard      | Next.js on Vercel (shadcn/ui)                              |
| Infra          | Terraform, AWS ECS Fargate                                 |

***

<Card title="Interactive Architecture Demo" icon="play" href="https://quintai.dev/demo/architecture-demo.html">
  Animated, interactive visualization of the full architecture — flow matrices, behavioral envelopes, scoring pipeline particles, intent-vs-truth correlation, and threat signature matching. Built for live walkthroughs.
</Card>