Specifications

What runs, where it runs, and what it enforces. Every line below is a shipped capability.

Two segregated zones. One signed path between them.

Sandbox and Production are separate deployments with no shared database, event bus or API path. The only thing that crosses is a signed OCI artifact in your own registry, and Production verifies each one before applying it.

Sandbox zone (Hub)Author, test, approve

Studio, Tests, release approval
Own PostgreSQL 16, Redis and PDP
Own credential store (sandbox keys)
Own audit chain
Own OIDC client
Roles: viewer, builder, approver, admin

push, signed

Your OCI 1.1 registry

Signed release bundle
Policy exception
Organization access state
Knowledge-base corpus

Rollback request

pull, verify, apply

the only thing Production can push

Production zoneRun signed releases only

Runtime: leased queue, horizontal workers
Own PostgreSQL 16, Redis and PDP
Own credential store (production keys)
Own audit chain
Own OIDC client, step-up MFA
Roles: viewer, approver, ops, admin
No authoring tools deployed

No shared database
No shared event bus
No API path from Sandbox to Production
Credentials never cross
Production runs on if the Sandbox is down

Crosses the boundary

Release bundleWorkflow version, compiled policy, capability manifest, output schemas, evaluation summary

Policy exceptionTime-limited, one workflow, one guardrail; revocation always wins

Organization access stateWhich organizations may run, signed per organization

Knowledge-base corpusContent for retrieval, versioned with the release

Rollback requestFrom Production back to the Sandbox, decided there as a change approval

Never crosses

Credentials, keys and secrets

Run data, prompts and responses

Production audit records

User sessions and tokens

Any network call between the zones

Production refuses

An artifact signed for another organization

An older release, unless a signed rollback names it

A registry credential that can do more than push rollback requests

Air-gapped Production? Copy the artifacts across with standard OCI tools. Verification is the same.

Runtime and execution

Engine: LangChain v1 and LangGraph; one execution substrate for interactive and unattended runs
Scale-out: Leased queue, horizontally scaled workers, resumable streams; any worker resumes a paused run
Composition: Workflow-as-node pinned to a version; 5-level nesting limit, recursion guard, one budget per root run
Triggers: Chat, schedule, webhook, file watch, event stream (Kafka), mailbox (Microsoft 365, Google Workspace)
Output contracts: Named output schemas, frozen into the release and enforced in Production

Policy and guardrails

Decision point: One PDP for model, tool, retrieval and memory calls; unknown or unreachable means deny; runs on last good policy if the registry is down
Composition: Platform floor, organization baseline and agent policy; the strictest wins and a lower layer never grants
Rule types: Parameter bounds, context attributes (data class, time, geography, channel), session trajectory limits; deny or hold
Guardrail floor: Prompt injection (including retrieved content), PII in output, harmful output, cite-or-flag grounding; cannot be disabled
Autonomy: Declared level per agent, advisory to supervised-autonomous; the organization can tighten the autonomy and action-class matrix
Kill switch: Per organization, agent, tool or MCP server; opens an incident; release needs a second person; survives cache loss

Human-in-the-loop

Decision Requests: Customer consent, operational approval and change approval in one model and one Inbox
Separation of duties: Four-eyes as one organization setting; change approvals check both author and deployer
Timeouts and resume: Waiting never approves; a paused run resumes as its initiator, never as the approver
Email approval: One-time-code protected link; five wrong codes close it permanently

Release and supply chain

Transport: Signed OCI 1.1 artifacts in your registry; Production pulls, verifies signature, organization and version, then applies
Release review: Diff to live, capability manifest (read or write, target system, action class), evaluation summary for information
Rollback: Signed rollback request from Production, decided in the Sandbox as a change approval
Product releases: Helm charts, images by digest, SBOM per image, cosign signatures, dependencies locked by hash

Identity and access

Identity provider: Keycloak 26 brokering OIDC (Entra ID, Okta), SAML (ADFS) and LDAP / Active Directory; no passwords stored
Zone scoping: Separate OIDC client per zone; Sandbox and Production role sets; step-up MFA for Production roles
Group placement: Directory groups mapped to organizations, workspaces and roles, with preview; an unmapped group grants nothing
Service identity: Short-lived signed workload attestations; default-deny Kubernetes NetworkPolicies; no service mesh required
Agent identity: Organization, user, session and grant travel in a broker-signed context, never from a request body

Tenancy and data protection

Isolation: Organization id on every row under PostgreSQL row-level security, verified at startup in every process
Encryption: Envelope encryption: per-organization versioned data keys wrapped by a KMS master key; deleting keys crypto-shreds secrets
Secrets: By reference: Kubernetes Secrets, External Secrets, CSI, Vault; literal secrets refused in production
Residency: Region label on every model connection; unlabelled connections refused by any rule that names regions

Audit and evidence

Audit chain: Hash-chained, per-organization sub-chains, signed checkpoints, KMS/HSM keys with rotation; verified on schedule and on demand
WORM copy: Optional write-once copy to an object-lock bucket, compliance or governance mode
Evidence packs: Signed, framework-formatted exports, checkable with a standalone offline verifier
Conformity: EU AI Act, DORA, ISO 42001, SR 11-7, SAMA, BDDK mapped to live controls; support for assessment, not certification
Erasure: Subject erasure redacts and appends an erasure proof; the chain still verifies

Models

Connections: Base URL, auth (none, API key in any header, bearer, mTLS, OAuth2 client credentials), headers, region label, served models
Self-hosted: OpenAI-compatible endpoints: vLLM, Ollama, TGI, LM Studio, LiteLLM
Cloud presets: Anthropic, OpenAI, Google, Amazon Bedrock, Azure OpenAI
Probe: Connection saved only after each declared model answers; failures named as DNS, TLS, certificate, auth or model not served
Routing: Task tier and fallback within the policy-allowed set; every choice audited with its reason
Errors: Content filter, rate limited, authentication, model unavailable, context too long, provider error; bounded backoff, streaming

Integrations and retrieval

Connectors: Microsoft 365, Teams, Google Workspace, Slack, ServiceNow, Jira, Salesforce, SAP, SharePoint, SQL, GitHub; OAuth per zone
Custom tools: MCP servers, REST, database and notification tools; MCP service generator from an API description
Egress guard: Every address checked when dialled, including redirects; allow-list and pinning
Knowledge sync: Folder, git, SharePoint, S3, Confluence, Google Drive; OCR for scans; pgvector
Retrieval: Entitlement-filtered; agentic multi-hop within hop and cost limits; citations with cite-or-flag

Observability and operations

Telemetry: OpenTelemetry export, SIEM, Prometheus metrics without organization content in labels, reference Grafana dashboards
Incidents and alerts: Durable incidents; signed webhook, Slack, Teams, PagerDuty or email through a retrying outbox
Anomaly detection: Statistical and ML baselines per agent, poisoning-resistant, every flag explained
Backup and restore: Every store; hash-checked restore ending in audit-chain verification; RPO and RTO stated per store
Support bundle: Versions, digests, migration heads, readiness and redacted logs per zone

Deployment

Helm charts for one cluster or two. Nothing leaves your network unless you configure it to.

Your network

Sandbox zoneStudio and testsRelease approval

Your release registrysigned artifacts only

Production zoneRuntime and policyAudit chain

The only shared endpoints:Your release registryKeycloakMail relay

Outbound only where you configure it

Model endpointsYour systems

What you bring

KubernetesOne cluster with two namespaces, or two clusters.

PostgreSQL 16 with pgvectorChart-managed or your managed instances.

RedisOne per zone.

Object storageS3-compatible, Azure Blob, a shared filesystem or the bundled store.

An OCI 1.1 registryFor releases and the signed artifacts between zones.

Your identity providerEntra ID, Okta, ADFS or LDAP, through Keycloak 26.

KMS or HSM and a secret storeFor signing, master keys and credentials.

Model endpointsYour inference servers, a gateway, or cloud keys.

One cluster or two

Sandbox namespaceProduction namespace

One clusterTwo namespaces with default-deny network policies between them.

Sandbox cluster

Production cluster

Two clustersSeparate clusters. Only TLS to the registry, Keycloak and mail relay.

Either way, nothing flows from the Sandbox to Production except signed artifacts. Air-gapped? Copy them across with standard OCI tools.

Install in five steps

1PullCopy the signed release into your registry.
2VerifyCheck every image with cosign verify.
3InstallHelm charts for identity, Sandbox and Production.
4ConnectYour directory, KMS, storage and models.
5ValidateRun the guide’s checks, create the first organization.

Built to be operated by you

Safe upgradeshelm upgrade migrates schemas before new pods serve.

Documented rollbackhelm rollback plus a tested downgrade per schema.

A licence that never holds data hostageVerified offline. If it lapses, reads, exports and the kill switch keep working.

Guides for your IT teamInstall, upgrade and sizing guides for both layouts.

See your own workflow governed, end to end.

A 30-minute demo on a workflow from your world. No slides.

Book a demo Ask about services