Atlas Architecture.
A governance and orchestration layer that controls how models access enterprise data — enforcing policy, minimizing exposure, and producing audit trails.
Six layers. One request path.
Clients never touch the runtime or the data directly. Every request descends through the control plane and the data plane, and every layer is observable.
Nine steps. None optional.
Every request follows a deterministic path through Atlas. If any stage fails, the request is rejected with a structured error and an audit event is emitted.
Identity, classification, operation.
Three dimensions bind every decision. Policies are evaluated on every request — no caching of authorization decisions across requests.
allow { input.user.role == "analyst" input.collection.id == "collection-a" input.operation in ["read", "retrieve", "summarize"] not input.document.tags["PCI-high"]} allow { input.user.role == "legal" input.zone.id == "zone-b" input.operation == "agent-summarize"} deny { input.model.id == "gpt-4" input.zone.classification == "classified-research"}
Principals map to roles via IdP claims; roles carry collection-level permissions. No implicit access.
Classification tags set the ceiling for what a request may touch and which transforms apply.
Each operation is whitelisted per role and zone. Agents and tool calls are gated the same way as people.
Everything inside. Nothing out by default.
The whole system — control plane, data plane, vector store, inference, audit, secrets — runs inside the customer environment.
- Atlas Control Plane + Data Plane
- Vector DB (Qdrant)
- Model Inference (vLLM / local)
- Data Sources (Starfish, filesystems, DBs)
- Audit Logs + Metrics Store
- Policy Engine + Configuration
- Secrets Store (Vault / K8s)
External model APIs (OpenAI, Anthropic, etc.) are supported but require explicit configuration per-zone. External connections are logged and subject to policy evaluation. No data leaves the environment without an auditable decision chain.
No data egress by default. External connections require explicit configuration, policy approval, and produce audit events on every call. Air-gapped deployments have no external network path.
One immutable record per request.
Records are append-only, tamper-evident, and exportable to external SIEM systems. The schema below covers the core fields emitted per request.
From a laptop to an air gap.
The same binary, the same policy bundle, the same audit schema — at every scale.
- SQLite for metadata, embedded Qdrant
- Local GGUF model via llama.cpp
- Self-signed TLS for local development
- Single binary distribution
- No external network dependencies
- Minimum 3 Atlas replicas behind load balancer
- Postgres with streaming replication
- Qdrant cluster with sharding + replicas
- vLLM model pool with health checks
- TLS termination at ingress, mTLS internal
- Secrets via Vault or K8s secrets
- Rolling upgrade with canary validation
- OCI-compliant artifact bundle for offline install
- Local model weights, no download at runtime
- Internal CA for certificate management
- Upgrade via signed artifact transfer
- Rollback to previous version within 60s
- No DNS, NTP, or package manager calls
All internal and external traffic encrypted. mTLS between Atlas components. Configurable cipher suites.
Vault integration or K8s secrets. No secrets in environment variables or config files. Rotation without restart.
Rolling upgrades with automatic rollback on health check failure. Schema migrations are forward-compatible.
Closed on every failure path.
There is no degradation mode that silently bypasses policy or drops audit events.
All requests denied. No bypass. Alert fires to ops channel within 30s.
Circuit breaker opens after configurable error threshold. Partial results returned with degraded flag. Automatic recovery probe.
Request queued with TTL. Per-tenant rate limits enforced. 429 returned when queue depth exceeds threshold. Priority lanes for critical tenants.
Audit events buffered to local WAL. If buffer fills, requests are rejected. No silent audit gaps.
Six contracts. Four required.
Atlas integrates through stable, documented contracts — swap a component without rewriting the system around it.
Starfish provides the data organization layer. Atlas reads zone definitions, collection metadata, and classification manifests. Sync is pull-based on configurable interval.
OpenAPI-compatible vector operations. Primary support for Qdrant. Filter expressions enforce tenancy and classification at query time. Batch upsert for ingestion pipelines.
Chat completions and embeddings endpoints. vLLM for self-hosted models. Model registry tracks available models, versions, and capability tags.
Standard OIDC discovery or SAML metadata import. Group-to-role mapping configurable via admin API. Supports multi-IdP for federated environments.
Structured audit events exported in CEF or JSON. Supports syslog (TCP/TLS), webhook POST, or local file rotation. Configurable export filters.
Built-in policy engine for standard RBAC. Optional OPA sidecar for complex Rego policies. Policy bundles versionable and auditable.
See Atlas in your environment.
We deploy Atlas on your infrastructure, with your identity provider, against your data sources. No SaaS dependency. No data egress.
