Tarka

Tarka checks events against rule packs written in JSON and returns allow, review or deny, keeping a receipt for every decision that records which pack decided it and why. Graph checks follow links between accounts, such as a shared device. New rules run in an observe mode first and a person promotes them to live; the model never promotes or demotes a rule on its own.

It runs on your own servers with Docker Compose, or on Kubernetes with Helm, with an analyst desk for reviewing decisions and looking into linked accounts. An optional investigation assistant uses a language model you supply. Tarka is in beta, with community support through GitHub issues.