# AI use cases for Halofy (halofyai/halofy)

Repo: [halofyai/halofy](https://github.com/halofyai/halofy) | Use cases: 4 | Page: https://dedupedai.com/use-cases/halofyai-halofy/

Halofy is an open source access and governance layer that gives AI agents across an organization one server-resolved identity, policy model, provenance trail, audit log, and signed erasure.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Run the offline governed context demo: https://dedupedai.com/use-cases/halofyai-halofy/run-offline-governed-context-demo/
- Connect an AI agent to shared context over MCP: https://dedupedai.com/use-cases/halofyai-halofy/connect-ai-agent-over-mcp-with-server-identity/
- Review agent access and audit in the control room: https://dedupedai.com/use-cases/halofyai-halofy/review-agent-access-and-audit-in-control-room/
- Self-host governed memory on Postgres: https://dedupedai.com/use-cases/halofyai-halofy/self-host-governed-memory-with-postgres/

## How to run the offline governed context demo with Halofy

Repo: [halofyai/halofy](https://github.com/halofyai/halofy) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README

Watch pinning, writes, search, fault recovery, and signed erasure run on a local kernel with no network.

**Who it is for:** An engineer evaluating whether a shared, governed memory layer fits their organization's AI agents, before committing any infrastructure.

**The problem:** It is hard to judge access control, audit, and erasure claims for AI agent memory without seeing them run end to end.

**The outcome:** A working local kernel that shows a policy pinned, context assembled, a write made, an L3 fault recovered, and a forget operation that returns a verifiable certificate.

### Steps

1. Clone the repository with `git clone https://github.com/halofyai/halofy.git`
2. Change into the kernel folder with `cd halofy/kernel`
3. Install dependencies with `npm ci`
4. Run the offline story with `npm run demo`
5. Run the test suite with `npm test`

### Prompt to paste into your agent

```text
Clone https://github.com/halofyai/halofy, go to the kernel folder, run npm ci and npm run demo, and report the lines that show the fault result and the certificate verification. Verify that the output includes 'verifyCertificate === true' and that no API key was required.
```

### Caveat

The demo runs on embedded PGlite with a deterministic stub model and hash embedder, so it shows the governance behavior but not production model quality.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/halofyai-halofy/run-offline-governed-context-demo/

## How to connect an AI agent to shared context over MCP with Halofy

Repo: [halofyai/halofy](https://github.com/halofyai/halofy) | Difficulty: Advanced | Time: 30 minutes | Basis: From the README

Give an agent a key that fixes its namespace, actor, and role on the server before it reads or writes.

**Who it is for:** A developer whose team wants an AI coding or support agent to use shared organizational context without the agent asserting its own identity.

**The problem:** Agents that send their own identity fields can claim access they should not have, and their actions are hard to trace.

**The outcome:** An MCP-connected agent whose namespace, actor, and role are resolved from its API key, with every read, write, and denial recorded in the audit trail.

### Steps

1. Start the kernel folder with `cd kernel`
2. Generate a key for the agent with `npx tsx src/cli.ts keygen org/support/agent-1 user:dana owner`
3. Store the printed key in the HALOMEM_API_KEY environment variable as shown by the key output (format hm_...)
4. Start the MCP server with `HALOMEM_API_KEY=hm_... npm run mcp`
5. Point your agent's MCP client at the running server and run one memory search

### Prompt to paste into your agent

```text
In the halofy repository, go to kernel, generate a key for namespace org/support/agent-1 with keygen, and start the MCP server with that key. Report the namespace and role the server resolves for the agent, and confirm that the MCP tool schemas do not accept caller-supplied identity fields.
```

### Caveat

The README shows the keygen and MCP commands but does not show how a specific agent client is configured, so the connection step depends on that client's own MCP setup.

Risk, credentials: The generated API key grants the agent its namespace and role, so store it in a secret manager or environment variable and never commit it to source control.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/halofyai-halofy/connect-ai-agent-over-mcp-with-server-identity/

## How to review agent access and audit in the control room with Halofy

Repo: [halofyai/halofy](https://github.com/halofyai/halofy) | Difficulty: Intermediate | Time: 15 minutes | Basis: From the README

Open the console to check access, policies, conflicts, and audit events across agents.

**Who it is for:** An operator or compliance reviewer who needs to see what organizational agents can access and what they have done.

**The problem:** Without a central view, access rules and agent activity are spread across tools and hard to review.

**The outcome:** A browser view of access, teams, sources, policies, conflicts, retrieval quality, audit, and alerts for the running kernel.

### Steps

1. Change into the kernel folder with `cd kernel`
2. Start the API and control room with `npm run serve`
3. Open http://localhost:8787/console/login in a browser
4. Sign in and open the audit and policy sections to review recent events

### Prompt to paste into your agent

```text
In the halofy repository, go to kernel, run npm run serve, and open http://localhost:8787/console/login. Report which sections of the control room are available, and verify that the audit section lists recorded events after one write has been made.
```

### Caveat

The local server runs the console for a single kernel instance, and the README points to the self-hosting guide for a durable deployment with Postgres.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/halofyai-halofy/review-agent-access-and-audit-in-control-room/

## How to self-host governed memory on Postgres with Halofy

Repo: [halofyai/halofy](https://github.com/halofyai/halofy) | Difficulty: Advanced | Time: 45 minutes | Basis: From the README

Run a durable kernel on Postgres and pgvector with Docker Compose, backups, and generated keys.

**Who it is for:** An IT or platform engineer who must keep organizational context on their own infrastructure for a team of agents.

**The problem:** A local demo database does not meet the durability, backup, and key management needs of a shared organizational deployment.

**The outcome:** A self-hosted kernel with Postgres as the authority, generated keys, Docker Compose, and a documented backup and restore path.

### Steps

1. Read the self-hosting guide at docs/self-hosting.md in the Halofy repository
2. Set up Postgres with pgvector as the guide describes
3. Generate keys for your agents and operators using `npx tsx src/cli.ts keygen` from the kernel folder
4. Start the stack with Docker Compose as the guide describes
5. Test a backup and a restore before connecting production agents

### Prompt to paste into your agent

```text
In the halofy repository, read docs/self-hosting.md and list the steps needed to run the kernel on Postgres with Docker Compose. Verify that the guide covers backups and restores before reporting the plan.
```

### Caveat

The README points to docs/self-hosting.md for the Postgres and Docker Compose steps, so the exact commands are not included here and must be taken from that guide.

Risk, credentials: Generated keys and the Postgres password control access to all organizational context, so store them in a secret manager and rotate them according to your policy.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/halofyai-halofy/self-host-governed-memory-with-postgres/