Where the boundary sits.
Anubis adds one synchronous call to your agent's tool path and one control plane your security team operates. It does not sit in your network path, does not host your agents, and does not need to see your data.
Four layers, and only one is in the hot path.
LangChainLangGraphCrewAIAutoGenOpenAI Agentscustom runtime
framework adapterPython SDKTypeScript SDKRESTCLI
credential → identitytrust gatepolicy resolutiondeterministic evaluationrisk scoringevidence write
agent registrypolicy authoringcredential administrationapproval queueaudit logcontainment
Supabase PostgreSQLrow-level tenant isolationtransactional evidence
Only layer 03 is in the hot path of an agent's tool call. Everything else is operated by people, on their own schedule.
Almost every design question is answered by this split.
The runtime and the control plane are not interchangeable, and no client will let you use one where the other belongs.
The lifecycle of a decision.
authenticate
The credential resolves one organization, one agent, one environment and a scope set. Anything missing, malformed, revoked, expired or foreign refuses identically.
validate
The body is bounded and the input is capped on depth, size and node count. Identity assertions in the body are cross-checked, never trusted.
trust gate
Lifecycle state and containment. A contained agent stops here and policy is never reached.
resolve policy
The policy bound to this agent, at its current version. No applicable binding does not fall through to permission.
evaluate
Deny rules, allow-lists, thresholds. Deterministic, with the matched rule recorded.
score risk
Computed server-side against the policy threshold. Never supplied by the caller.
persist
Runtime event, approval if held, and audit entry, in one transaction. Failure here becomes a refusal.
respond
One of three values, with its provenance and evidence ids.
What deployment looks like today.
No public hosted endpoint. There is no shared Anubis URL to point at. A deployment sets its own base URL, and we set that up with you.
No IaC package shipped. Anubis does not currently ship a production Docker topology, Kubernetes manifests or a Terraform stack. Disposable local infrastructure exists for development and CI.
TLS and secrets are yours. The credential is a bearer token, so TLS is the transport defence. Anubis returns a secret once and stores no copy; where it lives afterwards is your secret manager's job.
Also not shipped today: production observability, SLOs, backup and restore or DR tooling, rate limiting, SSO/SAML/OIDC, and SIEM export.
Anubis is in private access. We would rather be exact about this than let you plan against something that does not exist yet.
Private access
Walk the architecture with us.
Bring your stack. We will show you exactly where the one call goes and what it costs you.