Quickstart
Run the control plane locally.
The local path proves routing and policy behavior. It is not a production deployment profile and should not be exposed directly to the public internet.
cp config.example.json hormuz.json
export HORMUZ_TOKEN="replace-with-a-long-random-token"
export OPENAI_API_KEY="your-company-openai-key"
export ANTHROPIC_API_KEY="your-company-anthropic-key"
python3 -m hormuz --config hormuz.json doctor
python3 -m hormuz --config hormuz.json serveCredential boundary: employees authenticate to Hormuz; provider credentials stay on the Hormuz server and are never forwarded back to the client.
Core concepts
Four contracts, one request path.
Identity
Resolve the organization, team, person, client, and authorization profile before durable access or provider work.
Policy
Combine organization, team, and person rules monotonically so lower scopes can tighten controls, never weaken them.
Egress
Apply model access, budgets, privacy rules, DLP, and any exact-request approval before the provider call.
Evidence
Record bounded identity, policy, usage, cost, and security outcomes without retaining the prompt or response body.
Reference library
Go deeper by control surface.
OIDC & session broker
Standards-based sign-in, short-lived Hormuz sessions, secure client custody, and immediate revocation.
Open reference ↗ControlPolicy administration
Stage immutable policy versions, activate with compare-and-swap, inspect the active version, and roll back.
Open reference ↗EvidenceUsage administration
Read scoped team and organization usage with content-free audit evidence and explicit coverage boundaries.
Open reference ↗OperationsDeployment contract
Health, readiness, capacity, deadlines, graceful drain, and the controls that remain deployment-owned.
Open reference ↗