How it works

                         ┌──────────────────── Garrison appliance (DGX Spark) ────────────────────┐
  Analysts ── browser ──►│  Console (HTTPS 443) ─► Garrison backend ─► AI gateway ─► local models  │
                         │                              │        (Open Agent Fabric)               │
                         │                              ├─► Grafana · Prometheus · Loki            │
                         └──────────────┬───────────────┼─────────────────┬──────────────────────┘
                                        │               │                 │
              agents connect out (8080) │      connectors (HTTPS APIs)    │ logs and metrics in
                                        ▼               ▼                 ▼
                         Linux / Windows systems    SIEM · cloud · firewalls · WAFs

The pieces

The appliance. One DGX Spark runs everything: the console, the Garrison backend, the AI models and the observability stack. More boxes can join to run larger models (Add boxes).

Agents. A small Garrison agent on each Linux or Windows system you enrol. It connects out to the appliance over TLS, so no inbound port is needed on the system. It runs the commands you approve, opens terminals for authorized users, and reports health. See Linux systems and Windows systems.

Connectors. API connections to your cloud accounts and clusters (AWS, Azure, Kubernetes, Hetzner), your SIEM (LevelBlue USM Anywhere, Elastic Security) and your security devices (FortiGate, Cloudflare WAF, AWS WAF). Credentials are stored encrypted on the appliance.

The AI gateway. Every model call goes through the gateway of Open Agent Fabric, which picks the model, enforces guardrails and records a trace. Admins see every prompt and answer in AI Audit.

The approval gate

Garry and the automations can read on their own: list processes, check disk space, query the SIEM, describe cloud resources. Anything that changes something is proposed instead:

1. Garry (or a case, a finding, a hunt) proposes a change and shows the exact command or rule.
2. It waits in Approvals, and in the chat where it was asked.
3. A person approves it. Only the command that was shown runs; nothing else the request carries.
4. The result and who approved it are recorded in the audit log.

The appliance decides what counts as read-only, not the AI model. A command is read-only only when every program in it is a known read-only program without its writing flags, piped only into plain text filters, with no redirects or substitution and nothing that touches credentials. Scheduled jobs that run while nobody is watching are limited to these read-only commands.