Security & architecture
Giving an AI agent access to production raises fair questions about data, secrecy, and control. Here is how the architecture answers them.
At a glance
One Helm install. No Infraware control plane, no channel back to us.
Every command Virgil runs passes a gate: reads go through, anything that writes is rejected and waits for a signature. How the gate parses every command.
The signed command runs once, as a scoped job bounded by your RBAC.
Who approved what, on what evidence, and what ran.
Your key, your provider, or in-cluster with vLLM. Once running, the only outbound calls are the model endpoint and, unless you mirror it, the executor image approved commands run in.
The alert, the conversation, what Virgil has learned, summaries of your stack and runbooks, and the full output of the read-only commands it runs, not redacted. Leave Secrets out of the read role, or point it at a model served inside your own boundary.
The whole system · one picture
Outbound, once running: the model endpoint you configure and, unless you mirror it, the executor image. No control plane, no telemetry, no channel back to us.
Controls
Where it runs
Configurable AI provider and model options give you a range of provider risk and execution tradeoffs, including a strict on-premises configuration with the model served inside your own boundary. There is no Infraware control plane and no channel back to us: the deployment is yours, end to end. With an external model, each call carries what the model sees, listed above.
Human oversight and control granularity
Infraware provides agent security with layered controls: technical conformance balanced with human factors. Different scales of control apply, from human-in-the-loop approvals to automated actions, and the control granularity ranges from individual commands to batches or permission scopes of accounts and different permission envelopes.
Identity and access management
Engineers sign in to the console with their own accounts, local to your installation, with passwords hashed with argon2id. Every approval is made by a named account, and the audit entry carries that name.
Execution mapping
Actions that touch infrastructure execute under configurable service account and RBAC mappings. Narrowly scoped execution environments apply the principle of least privilege to every change.
Audit and accountability
Agent logs carry session-level traceability: what was changed, who (or what) changed it, and what authority was used. The log can be stored locally or streamed to the service or storage backend you choose.
Talk to us
Book a meeting to walk through yours.
