Atria
Back to home

Evaluate

Watch it refuse something, on your own machine

A zero-trust proxy is a claim until you see it turn a call down. This kit starts the real package, plays an AI agent against it, and checks every outcome against the policy — an allowed call, six refusals, a rate limit and a revocation. It takes about a minute, runs entirely offline, and reports nothing back to us.

shell
curl -fLO https://apt.dbinvent.com/paks/atria-eval-latest.tar.gz
curl -fL https://apt.dbinvent.com/paks/atria-eval-latest.tar.gz.sha256 | sha256sum -c -

tar -xzf atria-eval-latest.tar.gz && cd atria-eval-*/
./evaluate.sh

The verdict

Ten calls, and what the boundary does with each

Every line is checked, not just printed: the script exits non-zero if any call behaves differently from what the policy says, so it is a test you run rather than output you have to read carefully.

  • 200

    an order inside the boundary

    allowed endpoint, value under the ceiling

  • 403

    an endpoint it was never grantedENDPOINT_NOT_ALLOWED

    anything not explicitly allowed is denied

  • 403

    an order over the transaction ceilingTRANSACTION_VALUE_EXCEEDS_LIMIT

    the action boundary, not just the route

  • 403

    the same value hidden as a stringTRANSACTION_VALUE_NOT_NUMERIC

    a value the proxy cannot compare is one it cannot bound

  • 403

    the same value hidden by nestingTRANSACTION_VALUE_EXCEEDS_LIMIT

    the whole document is inspected, not just the top level

  • 403

    a path that walks upwardsPATH_REJECTED

    encoded separators are refused rather than guessed at

  • 403

    a valid certificate, no policy entryNO_POLICY_FOR_AGENT

    default-deny: nothing works until you name the agent

  • ---

    a certificate from a CA it never pinned

    the handshake fails — no request is ever formed

  • 429

    the call after the budget ran outRATE_LIMIT_EXCEEDED

    counted per agent, across all its certificates

  • 403

    the same call, after a revocationCERTIFICATE_REVOKED

    the certificate is still valid — the list is what stops it

Two ways in

Containers for the behaviour, a real host for the deployment

Docker

Four containers, one of which is the real package. Leaves nothing behind — --down removes the containers, the volumes and the throwaway keys inside them.

shell
./evaluate.sh
./evaluate.sh --down

Ansible

The actual .deb on a Debian or Ubuntu host, under systemd: a service account, a unit file, an audit log under logrotate — and an uninstall that leaves the machine as it was.

shell
cd ansible
ansible-playbook evaluate.yml
ansible-playbook evaluate.yml \
  --tags uninstall

What is real in it

The proxy is ours. Everything around it is yours to read.

atria-proxy is the published package, installed from the signed repository and unmodified — every decision you see is that binary making it. The three things around it are scaffolding, and deliberately small enough to audit: a cloud stand-in built from openssl and ninety lines of Python, a backend that answers everything and records what arrived, and an agent played by curl. None of them contain any Atria code.

The cloud is stood in for rather than called so the evaluation needs no account and no network — and because it demonstrates the property the product rests on. The proxy verifies every certificate offline, against a CA pinned at install time, and makes no call to us on the request path. Disconnect the stand-in mid-run and the boundary keeps enforcing exactly as before.

The kit does show a simplified enrolment — POST /register mints an API key for whatever agent id you ask for, and POST /sessionrequires it, the same two calls in the same order as production. What it doesn't show is the real thing behind them: a durable account, the issuance policy that decides who actually gets a key, and a cloud reachable from anywhere but your own machine. That's what the sandbox walkthrough is for, against a live, publicly reachable stand-in: five calls, no account, and a Swagger console.

The part that matters

Point it at your own backend

The interesting question is not whether the proxy blocks the examples we chose. Change one line, name your own agents and endpoints in policies.yaml, and apply it without a restart or a dropped connection.

proxy.env
ATRIA_UPSTREAM_URL=http://host.docker.internal:3000
shell
docker compose exec proxy atria-reload

One agent, several backends: the line above is the default route. A request that carries a TA-Proxy-Pass: <host> header is sent there instead — but only if that host is in the certificate’s scope set, which is fixed when the agent’s API key is issued and nothing in the request can widen.

A policy that fails to parse is refused and the previous one keeps enforcing, so a bad edit cannot open the boundary. Try it and read the reply.

Install it for realAsk us something