MAQPNADocs

Tutorials overview

Pick an end-to-end tutorial by goal, time and level, from a support agent on your laptop to a sovereign EU installation on a cluster.

Each tutorial starts in an empty folder and ends with a working, governed result. Every one has a diagram of what you build, prerequisites, numbered steps with commands and files you can copy, a check after each major step, a recap, cleanup and next steps.

Most tutorials run on a laptop with a local MAQPNA started by maqpna dev up: the identity broker, the MAQPNA gateway and a test MCP server, with no Kubernetes. The ones marked Cluster need a Kubernetes cluster. kind is enough unless the row says otherwise.

flowchart LR
  S["Start:<br/>first governed agent"] --> A["Support agent<br/>DLP + approvals"]
  S --> C["Cost-controlled<br/>LLM app"]
  S --> L["LangGraph agent"]
  L --> M["Multi-agent A2A"]
  A --> P["Policy as code<br/>in CI"]
  P --> R["AI SRE agent"]
  P --> E["Sovereign EU<br/>deployment"]

Before you start#

Run Your first governed agent first. It takes five minutes and introduces the commands every tutorial uses: maqpna dev up, maqpna dev run, maqpna call, maqpna approvals and maqpna audit verify.

All tutorials#

Tutorial Goal Time Level Where What you learn
Support agent with DLP and approvals A customer-support agent that reads tickets and issues refunds, with personal data redacted and refunds over 100 EUR held for a human. 25 min Beginner Laptop Adding your own MCP server, DLP profiles, when conditions on arguments, approvals, the audit ledger
LangGraph agent The MAQPNA LangGraph template with its own policy, then the same code deployed to a cluster. 30 min, plus 10 for the cluster part Intermediate Laptop, then cluster The LangGraph adapter, local policies, approvals as interrupt(), offline policy tests, deploying with manifests
Multi-agent A2A A planner that hands work to a worker over agent-to-agent (A2A), with the human kept in the delegation chain. 40 min Advanced Laptop A2A routes, agents:<name> scopes, allowed callers, Txn-Tokens, delegation tokens, the chain in the audit ledger, revoking an agent
Policy as code in CI Policies in Git, linted and tested in GitHub Actions on every pull request, promoted from staging to production with GitOps. 45 min Intermediate Laptop and CI, staging on kind The PolicyTest suite format, maqpna policy lint, maqpna policy test --require-tests, maqpna validate, maqpna diff
Cost-controlled LLM app An app that calls a model through the gateway, with spend capped per session and per day and an alert near the limit. 20 min Beginner Laptop Model routes, pricing tables, budgets, threshold alerts, token-rate limits, reading spend
Sovereign EU deployment A production-like installation with the sovereign-eu profile, attested confidential sessions and keys you hold. 2 to 3 hours Advanced Cluster with confidential-computing nodes The sovereign-eu profile, sovereignty policies, maqpna sovereignty check, tier-2 attestation, customer-held signing keys
AI SRE agent An SRE agent that reads cluster state freely, but changes nothing without a human approval, and Terraform plans checked by blast-radius tier. 40 min Intermediate Laptop and a kind cluster The built-in maqpna-k8s server, read-only RBAC by impersonation, proposal and apply write modes, approval floors, taint, the kill switch

Which one first?#

Next steps#