products / Nautilus
[ OPEN SOURCE ] v0.1.5 · data governance · 2 000 m

Nautilus

Policy-first data broker for AI agents.

One request plans, routes, enforces, attests, and audits, with cumulative exposure tracked across a session.

// example nautilus 
from nautilus import Broker

broker = Broker.from_config("nautilus.yaml")
response = broker.request(
    "agent-alpha",
    "Find vulnerabilities for CVE-2026-1234",
    {"clearance": "unclassified",
     "purpose": "threat-analysis",
     "session_id": "s1"},
)
# plans → routes → enforces → attests → audits
// why Nautilus

What Nautilus does.

◆
One Call, Five Guarantees

Agents do not touch data sources directly. A single request call plans which sources to query, routes the request, enforces per-source scope and field constraints, signs the routing decision with an attestation, and writes a tamper-evident audit entry.

⧉
Cumulative Exposure Tracking

Individual requests look harmless. Accumulated across a session, they build dossiers. Nautilus keeps session memory of what each agent has already pulled and denies the next request when cumulative access crosses policy: accessed PII from three sources, deny the fourth.

✦
Deterministic Policy on Fathom

Enforcement runs through Fathom's CLIPS expert system, so decisions are deterministic and fail-closed, with no LLM in the path. Every routing decision is signed with an Ed25519 JWS attestation and appended to a JSONL audit sink.

// where it sits

Nautilus owns the data governance layer.

Each tool in the Kraken stack owns a single concern. Nautilus sits at the data governance tier — adopt it on its own, or descend the whole column.

Stargraph orchestration
Bosun action governance
Nautilus data governance · you are here
Fathom reasoning

Nautilus is a policy-first data broker for AI agents. Instead of giving an agent direct access to data sources, you give it one entry point: a request call. That single call plans which sources can answer the request, routes to them, enforces each source’s scope and field constraints, signs the routing decision with an attestation, and writes a tamper-evident audit entry. Nautilus governs what an agent is allowed to know, not how agents talk to each other.

The core problem it solves is cumulative exposure. Individual requests look harmless in isolation. An agent asks for org chart data, then personnel records, then travel schedules, each one reasonable on its own. Accumulated across a session, those three requests build a targeting dossier. Nautilus keeps session memory of what each agent has already accessed and evaluates the cumulative profile before every new request, so it can deny the fourth source when the first three already crossed a line. This is the mosaic effect, caught at the broker before the data ever reaches the agent.

Enforcement is deterministic by design. Policy runs through Fathom, a CLIPS-based expert system, which gives fail-closed inference with no hallucinations, full auditability, and no LLM in the decision path. Every routing decision is signed with an Ed25519 JWS attestation and appended to a JSONL audit sink, so any decision can be replayed and verified after the fact.

Nautilus is open source under Apache-2.0 and ships as the nautilus-rkm package on Python 3.13+. You configure sources in a nautilus.yaml file and run the broker with nautilus serve --config nautilus.yaml, over a REST transport or as an MCP server, including a fully air-gapped mode for offline and classified deployments.

// adjacent layers
← All products