Guides & Tutorials on The Mandrel Project

Getting Started

Mon, 01 Jan 0001 00:00:00 +0000

Governing an agent with Mandrel takes four steps: author a Mandrel Spec, validate it with the CLI, run the agent behind a Collet sidecar locally, then deploy the same spec to Kubernetes. This guide works through all four.

Prerequisites

Mandrel CLI installed:

go install gitlab.com/the-mandrel-project/mandrel-cli/cmd/mandrel-cli@latest

Container engine: Podman (recommended) or Docker, with Compose support.
A Kubernetes cluster (optional, for Tier 2+ deployment).

1. Create a Mandrel Spec

Every agent in the Mandrel mesh requires a declarative contract. Create a file named agent-spec.yaml:

Deployment Variants

Mon, 01 Jan 0001 00:00:00 +0000

The Mandrel Project is designed as a Universal Governance Overlay. While Kubernetes with the Gantry Operator is the reference “Gold Standard” for assurance, Mandrel’s enforcement logic is portable across any compute environment or agentic framework.

Architectural Patterns

Mandrel adapts its “Clamping” mechanism to match the native capabilities of the target platform.

1. The Sidecar (Kubernetes & Serverless)

The reference pattern where the Collet sidecar and the Agent share a network namespace.

Egress Governance Architecture

Mon, 01 Jan 0001 00:00:00 +0000

In an agentic mesh, outbound tool calls (MCP resources/tools) and downstream agent delegations are structurally equivalent from a governance perspective. Both represent an agent exercising authority outside its immediate boundary.

Mandrel governs egress traffic through a decoupled policy-and-proxy model, adapting to Kubernetes and non-Kubernetes environments alike.

The Decoupled Proxy Architecture

Mandrel separates policy definition from network-level traffic interception:

The Mandrel Collet: Evaluates business logic, identity (Compound Identity / SPIFFE), cost budgets (Chips), and governance matrices.
Envoy Proxy / Mesh Data Plane: Handles transparent iptables-based L3/L4 network interception, mTLS transport encryption, and connection pooling.

graph LR
 subgraph Pod / Container Group
 AGENT[Specialist Agent] -->|Outbound Call| ENV[Envoy Interceptor]
 ENV -->|Policy Check| COL[Collet Sidecar]
 COL -->|Permitted| GW[Egress Gateway / External System]
 end

Deployment Modes

1. Kubernetes with Gantry Operator (Gold Standard)

In Kubernetes environments managed by the Gantry Operator:

Kong Gateway & Mesh Integration

Mon, 01 Jan 0001 00:00:00 +0000

The Kong Gateway & Mesh Integration allows Mandrel to act as the declarative contract layer (“The Brain”) while delegating high-performance edge traffic control and routing enforcement to the Kong AI Connectivity platform (“The Muscle”).

By compiling a Realized Spec into native Kong Custom Resource Definitions (CRDs), platform teams can secure agent networks, restrict tool usage, and prevent runaway LLM loops without changing a single line of agent code.

The Translation Plugin (`mandrel-generator-kong`)

Mandrel features a subprocess-based mandrel-cli plugin discovered automatically on $PATH as mandrel-generator-kong.

Guides & Tutorials on The Mandrel Project

Getting Started

Prerequisites

1. Create a Mandrel Spec

Deployment Variants

Architectural Patterns

1. The Sidecar (Kubernetes & Serverless)

Egress Governance Architecture

The Decoupled Proxy Architecture

Deployment Modes

1. Kubernetes with Gantry Operator (Gold Standard)

Kong Gateway & Mesh Integration

The Translation Plugin (mandrel-generator-kong)

The Translation Plugin (`mandrel-generator-kong`)