Building Phinq: How a Cronjob Failure Forced Me to Redesign Agent Governance From Scratch

Short summary

Agent governance can't rely on individual tool hooks—each tool call passes through the LLM API, making that the enforcement chokepoint. Phinq implements a proxy-based system that classifies actions into risk levels (reversible vs irreversible), with pass-through monitoring to calibrate false-positive rates before enforcement. Hash-chained audit logs ensure the governance system itself can't be tampered with by agents.

• •Enforcement must sit at the LLM API call—the one chokepoint all tool calls pass through
• •Risk-based classification (reversible/irreversible) determines pass vs hold behavior with zero false positives before activation
• •Hash-chained audit logs prevent the governed agent from tampering with its own audit trail

Generated with AI, which can make mistakes.