Available locally
Policy artifacts
Load constrained YAML or JSON, validate it against a versioned schema, and derive a canonical identity for the exact policy.
Open source
Inspect the contract. Run the evidence.
Antaeus is an early, Apache-2.0 implementation of semantic policy infrastructure. The public repository supports an exact local workflow and an experimental bring-your-own-key semantic evaluator; it does not ask you to mistake either for a measured, stable product.
Current implementation
A usable local core, with each boundary named.
These capabilities ship in v0.6.0 and the default branch. Availability here is not a stable v1 API or a production support commitment. For the concept behind them, readwhat semantic policy enforcement is.
Available locally
Decision contract
Return typed allow, review, deny, or failure outcomes with normalized evidence through a provider-neutral boundary.
Available locally
Named regression cases
Bind an input and expected outcome to a policy version, then run the same deterministic path used by local evaluation.
Library and CLI controls available
Evaluator configuration
Inspect strict profiles, preflight credential references, establish project trust, and use bounded routing primitives without placing secrets in policy files.
Credential-free workflow
One policy. One exact case. Three checks.
Build the development command, validate the example policy, evaluate its checked-in fixture, and run the portable regression suite. The public quickstart explains the JSON results and exit behavior.
- 01
Validate identity. Parse the policy strictly and print its canonical digest and rule count.
- 02
Evaluate exact evidence. Match policy, input, and fixture digests before producing a decision.
- 03
Check the expectation. Run the named case through the portable regression contract.
$ git clone https://github.com/antaeusio/antaeus.git
$ cd antaeus
$ scripts/build
$ .tmp/bin/antaeus validate \
contracts/examples/v0alpha1/policy/vendor-onboarding.yaml
$ .tmp/bin/antaeus evaluate \
--policy contracts/examples/v0alpha1/policy/vendor-onboarding.yaml \
--input contracts/examples/v0alpha1/input/aggregate-analytics.json \
--fixture-set contracts/examples/v0alpha1/fixture-set/quickstart.json \
--case aggregate-analytics
$ .tmp/bin/antaeus test \
--policy contracts/examples/v0alpha1/policy/vendor-onboarding.yaml \
--suite contracts/examples/v0alpha1/regression-suite/quickstart.json \
--fixture-set contracts/examples/v0alpha1/fixture-set/quickstart.jsonExact commands from the public quickstart; the example files come from the repository. To install the command instead of building it, run brew install antaeusio/tap/antaeus, go install github.com/antaeusio/antaeus/cmd/antaeus@v0.6.0, or docker run --rm ghcr.io/antaeusio/antaeus version, or download a checksummed archive from the v0.6.0 release. No Antaeus account or provider credential is used.
Repository boundary
Open code does not require open secrets.
The public project carries portable policy infrastructure. Provider credentials, customer content, hosted-service implementation, billing, and private production integrations stay outside it.
The repository contains
Portable contracts
Schemas, Go packages, CLI source, examples, conformance fixtures, governance, and the build workflow.
Your environment supplies
Local choices
Evaluator selection and, only when a remote adapter such as the experimental OpenAI evaluator is used, references to separately managed credentials.
Your application retains
Authority
Authentication, authorization, deterministic rules, side effects, and the action taken after a policy decision.
Maturity ledger
Build against what exists—not what is planned.
The default branch is useful for inspecting and exercising the contract. Compatibility can still change in minor releases before v1.0.0.
Reasonable today
- Read and critique the public contracts.
- Install v0.6.0 with Homebrew,
go install, the container image, or a release archive. - Run the exact local fixture and regression workflow.
- Try the experimental OpenAI evaluator on non-sensitive data.
- Experiment with policies in a development checkout.
- Contribute focused code, documentation, or contract feedback.
Not represented as shipped
- Signed or notarized macOS binaries.
- A measured, enforcement-ready semantic evaluator.
- A hosted Antaeus account or control plane.
- A production SLA or stable pre-v1 API promise.
Follow the engine's development in the release notes and engineering articles.
Start with the evidence
Run it, inspect it, then decide where to contribute.
The repository is the source of truth for implementation details, contribution expectations, and private vulnerability reporting, with channels detailed on oursecurity page. Have a question or proposal before opening an issue? Reach the maintainers athello@antaeus.io.