PROBLEM
When an AI agent changes code, who has the final say?
AI agents are useful. Unreviewed changes are a different story. Before a change lands, five questions should be answerable:
What exactly is being changed?
Was this exact change authorized?
Did the applied change match the approved proposal?
Was the result verified?
Can the outcome be inspected afterward?
TANUQ adds a governed change workflow: risk and policy evaluation, content-bound authorization, controlled application, verification, and evidence.
AI coding agents write code and change files at machine speed, without human intervention. That speed is valuable — but not every change should go unchecked. The critical question is: who decides which changes need control?
When an agent applies a change straight to disk, the moment a human decides may come after the change rather than before it. At that point, rollback is costly and slow.
A fast agent does not mean its changes are automatically governed and evidenced. Speed and governance are different things: which change gets applied, who decides, and how that is proven are separate questions.
TANUQ fills that gap as an independent governance layer. It manages the governance step between the agent's proposed file change and its execution — assessing the proposal, requesting human approval for risky changes, applying the approved change, verifying it, and recording every step in the evidence chain.
HOW IT WORKS
Six steps.
Propose → Risk → Approval → Execute → Verify → Evidence. Every step is visible; authority never moves to the next step on its own.
From proposal to evidence: Proposal → Assessment → Approval → Execution → Verification → Evidence.
The agent does not write to disk directly; it sends a change proposal to TANUQ. The target file and its content become visible before anything is applied.
Every proposal is classified: acceptable changes can be applied, risky changes wait for your approval.
You keep the decision on risky changes. Nothing is applied without your approval.
Approved changes are applied atomically. They never leave the approved scope.
Compilation and tests run after the apply. If verification fails, the rollback mechanism engages and the outcome is recorded.
Every proposal, approval and outcome is recorded. Later modifications to the record can be detected.
REAL PROOF · RECORDED RUN
What it looks like in practice.
A governance run recorded from a real TANUQ local run: Proposal → Risk → Approval → Fingerprint → Execute → Verify → Evidence. Served over HTTP, the recording plays step by step; opened directly as a file, you see the real summary of the same recording.
AI wants to change deploy_demo.py
HIGH RISK
APPROVAL REQUIRED
Recorded from a real TANUQ local run · recorded_real_run capture — no live API, no shell, no file writes
- 1PROPOSAL
- 2RISK
- 3POLICY
- 4APPROVAL REQUIRED
- 5APPROVE
- 6EXECUTE
- 7VERIFY
- 8EVIDENCE
approve → APPROVED · single-use · fingerprint-bound execute → Apply success: True verify → terminal state: VERIFIED · Verification passed: True evidence → chain VALID · anchor ACTIVE · ledger VALID · events 11
The recorded summary is shown statically. When the site is served over HTTP, this area plays the same run step by step.
VALUE
What you get.
CONTROL
You keep the decision on risky changes; nothing is applied without your approval.
VISIBILITY
Changes become visible before they are applied: which file, which action, which content diff.
VERIFICATION
Compilation and tests run after the apply; the outcome is verified.
EVIDENCE
Every proposal, approval and outcome is recorded. Later modifications to the record can be detected.
FEATURES
Capabilities that actually run.
Each item is part of the live governance chain and is verified by tests.
DETERMINISTIC RISK
Risk classification is rule-based and deterministic; the same proposal gets the same decision.
POLICY BINDING
Every proposal is evaluated within policy; behavior outside policy is denied by default.
AUTHORIZATION
Risky changes require explicit human approval before execution; no approval, no apply.
FINGERPRINT-BOUND
Approval is bound by SHA-256 fingerprint to the proposed content; if the content changes, the approval becomes invalid.
SINGLE-USE
Each approval is single-use; the same approval cannot authorize a second execution.
BOUNDED ATTEMPTS
Execution attempts are bounded; uncertain (UNKNOWN) outcomes are never treated as success.
CONTROLLED EXECUTION
Approved changes are applied atomically and never leave the approved scope.
VERIFICATION
Real tests and compilation run after the apply; if verification fails, the rollback mechanism engages and the outcome is recorded.
TAMPER-EVIDENT EVIDENCE
Every proposal, approval and outcome is written to an append-only record.
HASH-CHAIN LINEAGE
Records live in a hash chain; later modifications to history can be detected.
THE DIFFERENCE
Models change.
The governance and evidence layer must not.
Agent intelligence is replaceable. Governance state is not.
The model changes. The provider changes. The tool changes. The governance state TANUQ manages — fingerprint, approval, execution record and evidence chain — stays the same. The core is vendor-blind; decisions bind to the change itself, not to a person or a model.
Approval should be tied to the change — not just the conversation. Authorization is bound to the fingerprint of the proposed change. If the proposal changes, the authorization no longer matches. TANUQ then applies the authorized change, verifies the outcome, and records evidence using a tamper-evident chain with an HMAC anchor.
Validated today: the official Claude Code adapter and the general --stdin-json channel, tested end-to-end with a different model.
WHY TRUST IT
Trust comes from mechanisms.
Not a marketing claim; every step is deterministic, auditable and recorded.
Every proposal is identified by a SHA-256 fingerprint; approval binds to that identity.
Execution never starts on risky changes without explicit, single-use human approval.
If the content changes, the fingerprint changes; the old approval is invalid for new content.
Independent verification runs after execution; on failure the rollback mechanism engages.
Records are append-only and hash-chained; later tampering can be detected.
Unknown, missing or uncertain states are denied by default.
TANUQ governs changes submitted through its supported CLI, hooks, and adapters. It does not currently prevent an agent, editor, shell, or another process from writing directly to the filesystem outside that workflow. It is not an OS-level sandbox or filesystem enforcement system.
WHO IT'S FOR
Who is it for?
Add an independent control layer to your agent's change flow.
Add an independent governance layer to the agent change flow.
Evaluate AI changes within a policy framework.
Use a vendor-blind governance layer, separated from agent and model selection.
PRODUCT
The real flow that runs today.
Propose → Risk → Approval → Execute → Verify → Evidence
→ state: APPROVAL_REQUIRED · risk: HIGH
APPROVED deploy.py · risk=HIGH · single-use
terminal state: VERIFIED · Apply success: True · Verification passed: True
This excerpt is taken from a real TANUQ run. Approval is bound to the proposed change, and the outcome is verified after execution.
PRICING
Free to use.
TANUQ is free to use. No account, no payment, no subscription.
GET TANUQ · FREE
Install TANUQ and start using it.
TANUQ is free to use. The flow below is all it takes: install, connect your agent, govern your changes, use it in your real environment.
TANUQ is free to use: no account, no payment, no subscription.
Python 3.12+ is required. Install commands are in the Install section (Local Try) below.
The official Claude Code adapter, or the general --stdin-json channel that is not tied to a specific model.
Start a workspace with tanuq init and open the dashboard with tanuq ui; risky changes come to you for approval.
Your daily flow: proposal → risk → approval → execution → verification → evidence.
INSTALL · LOCAL TRY
Run the real runtime on your own machine.
The proof in the browser is a recorded playback. TANUQ is free: this is where you install it and run the real runtime on your own machine — it walks the governed flow end to end in a disposable workspace and cleans up afterwards.
TANUQ is distributed as source on this page, as version 0.6.0 on PyPI, and as the Windows installer below; everything needed to install is on this page.
Windows installer (v0.6.0)
DOWNLOAD TANUQ-SETUP-0.6.0.EXE
Windows 10/11 x64. Per-user install — no admin rights needed. It runs offline after install. No auto-update: a new version needs a new download.
The installer is unsigned (not code-signed); Windows SmartScreen / Defender may show warnings. Clean Windows acceptance: NOT TESTED — verified on a developer machine only.
Verify before installing: SHA-256 07be331e13cc24a2408ed50adb06f1151cdd16754f6d37d7c8c15f894ff5723d · SHA256SUMS.txt
Local install (Windows)
pip install -e . powershell -ExecutionPolicy Bypass -File site\try\try_tanuq.ps1
Local install (Linux / macOS)
pip install -e . bash site/try/try_tanuq.sh
Prerequisite: Python 3.12+. The run is fully local; no data is sent to a server.
Next step: start the TANUQ flow in your own workspace with tanuq init, then open the dashboard with tanuq ui.
Ubuntu Linux
Early access
Try TANUQ's Python-based CLI on Ubuntu. The Ubuntu CI installation and basic command checks pass; comprehensive validation in a real user environment is still in progress.
Experimental use — this is not full platform support.
Installation is from source: a copy of the TANUQ repository is required (the repository address is not shared on this page). Installation via PyPI has not been verified for Ubuntu/Linux. The steps below are verified in Ubuntu CI:
pip install -e . tanuq --version p5-server --help
Source install; comprehensive validation in a real user environment is still in progress.
FAQ
Before you get started
What is TANUQ?
An independent governance layer between your AI coding agent's proposed file change and its execution. The agent proposes; TANUQ assesses it, requests approval for risky changes, applies, verifies and records evidence.
Which agents does TANUQ support?
Two validated paths: the official Claude Code adapter and the general --stdin-json channel, which is not tied to a specific model (validated end-to-end with a different model). Other agent integrations are not yet validated.
What happens when I change agents?
The core is vendor-blind. Adapters only translate incoming tool events; fingerprint, risk, approval and evidence semantics stay the same. A new agent means a new translation module; the governance core does not change.
Does TANUQ replace my coding agent?
No. The agent writes and proposes; TANUQ governs that proposal. Your agent keeps working — the change flow passes through TANUQ.
How does approval work?
Required for risky changes: single-use, bound to the fingerprint (content), and time-limited (TTL). Nothing is applied without approval.
How is risk determined?
By a deterministic risk engine and policy — rule-based and independent of the proposal source. An LLM recommendation can only raise risk; it can never lower it.
What does verification do?
It runs compilation and real workspace tests after execution. If verification fails, the rollback mechanism engages and the outcome is recorded.
Why does evidence matter?
Every step is kept in an append-only hash chain. If a record is modified later, that can be detected; the evidence chain verifies independently.
How do I install TANUQ?
Python 3.12+ is required. Local install commands are in the Install section, together with the Windows installer download (v0.6.0).
Is TANUQ free?
Yes — TANUQ is free to use. Future pricing has not been decided yet.
How can I get TANUQ?
TANUQ is free to use. Install it from this page — see the Install section. There is no account and no payment.
What are TANUQ's limits?
It is not operating-system-level protection and not network enforcement; it does not sandbox your agent. TANUQ governs the change flow: it makes proposals visible, requests approval, verifies and records them.
FEEDBACK
Tried TANUQ? Tell us what happened.
TANUQ is free while we learn where it genuinely helps. Send your experience directly to the TANUQ team: press the button below and answer the five prompts in your own mail client. Nothing on this page collects data automatically.
WHAT WERE YOU PROTECTING?
Which change did you want governed?
WHICH AGENT?
Which agent or model did you use?
WHAT WORKED?
Where did risk, approval, verification or evidence actually help?
WHAT WAS HARD?
Where did you get stuck, and what was missing?
WOULD YOU USE IT AGAIN?
Would you use TANUQ again, and why?
We collect nothing automatically — no tracking, no accounts, no analytics. Feedback only reaches us when you send it yourself.