Concepts
How plugins, the graph, telemetry, detection, reasoning, and remediation fit together.
Agentshield is a pipeline around one graph. Detection is deterministic, a model investigates only what detection hands it, the checks after the model are deterministic, and a person decides what gets applied.
Start with Architecture for the whole path, then read the part you need.
Reference
Architecture
The pipeline from provider APIs to an approved fix, and where each stage keeps its records.
Graph
Resources, relationships, and facets with stable identities, versioned in PostgreSQL.
Telemetry
How logs enter, where raw events are stored, and how bounded rollups reach the graph.
Remediation
How a finding turns into a fix you approve, what each plugin can apply, and what verification proves.
Data model
Stable identities, content-addressed assertions, contributions, generations, and graph compilation.
Glossary
The vocabulary for resources, assertions, contributions, telemetry, findings, and remediation.
What agentshield does
The problem agentshield addresses, its end-to-end pipeline, and the components that make it work.
Security semantics
The neutral security vocabulary, provider coverage, and rules for interpreting declared and observed facts.