Skip to main content

​
Deployment topology

Akhara adds one component to your stack (the PDP) and one library to your agent (the PEP). Nothing else about your deployment has to change.
The PDP holds each agent’s baseUrl and API key server-side and never returns secrets: reads only expose a masked key. The PDP itself does not call your agent or your tools; it only evaluates the payload the PEP sends it.

​
The five enforcement stages

A single turn is gated at up to five points. You wire each with a PEP method; a latch may or may not fire at each.

​
Request lifecycle

Here is a full member chat turn that also performs a consequential action, showing every hop:

​
Where enforcement runs

Because the PEP is in-process and the PDP is a network call, latency and blast radius are predictable:
  • In-process PEP: no proxy, no sidecar to operate. One fetch/OkHttp call.
  • Synchronous decision: the side effect literally cannot happen before the verdict returns.
  • Stateless PDP calls: each authorize is self-contained; the only shared state is the append-only evidence feed.
In a sandboxed environment, the agent’s runtime boundary (e.g. android-emulator) is injected with a GATEWAY env var pointing back at the PDP, so enforcement stays in-path even inside the sandbox.