Skip to main content

A07 - Policy Enforcement

GroupTechnologyStatusServiceRoadmap phaseContracts
A - Governance, identity and securityDeveloped (PEP in each gateway)to developpolicies1policy-contract, audit-event

Back to index - Français

Role and responsibilities​

Enforcement points embedded in every gateway: call policy, apply obligations, record decisions.

Position in the architecture and interactions​

Embedded as a library in the Model, Tool, MCP, Knowledge, Data and Multimodal gateways: each one calls evaluate(principal, action, resource, context), applies obligations (mask, approval, cap) and records the decision. SDKs impose contracts, but only gateways, network policies and identities really enforce security.

Data model​

Tables (schema eai, every tenant table carries tenant_id uuid NOT NULL with an RLS policy on current_setting('app.tenant_id', true)::uuid): eai.policies, eai.policy_decisions, eai.audit_events.

API endpoints​

  • POST /v1/policies/evaluate
  • GET /v1/policies/decisions
POST /v1/policies/evaluate HTTP/1.1
Host: <control-plane-host>
X-API-Key: eai_xxx_secret
Accept-Language: en
Content-Type: application/json

{"schema_version": "1.0", "request": {"action": "models:invoke", "resource": {"type": "model", "id": "gpt-4o-eu"}, "context": {"data_classification": "confidential"}}}
{"decision": {"allow": false, "reasons": ["classification_exceeds_model"], "obligations": [], "decision_id": "dec_01H..."}}

Errors use the common envelope {"error": {"code", "message", "message_i18n", "details", "request_id"}}; lists are paginated with limit and cursor.

SDK usage​

Python (enterprise_ai):

from enterprise_ai import EnterpriseAI

client = EnterpriseAI(base_url="<control-plane-url>", api_key="eai_xxx_secret")
items = client.policies.list()

TypeScript (@enterprise-ai/sdk):

import { EnterpriseAI } from "@enterprise-ai/sdk";

const eai = new EnterpriseAI({ baseUrl: "<control-plane-url>", apiKey: process.env.EAI_API_KEY });
const items = await eai.policies.list();

Java (enterprise-ai-java):

EnterpriseAIClient client = EnterpriseAIClient.builder()
    .baseUrl("<control-plane-url>")
    .apiKey(System.getenv("EAI_API_KEY"))
    .build();
var items = client.policies().list();

Go (enterprise-ai-go):

client, _ := eai.NewClient(eai.WithBaseURL("<control-plane-url>"), eai.WithAPIKey(os.Getenv("EAI_API_KEY")))
items, err := client.Policies.List(ctx)

Configuration​

  • Environment: EAI_DATABASE_URL, EAI_OTEL_EXPORTER_OTLP_ENDPOINT.
  • Helm values: controlPlane.enabled, controlPlane.replicas, controlPlane.resources, controlPlane.config.

Security controls​

  • Authentication by OIDC JWT, tenant API key with scopes, or SPIFFE mTLS; tenant resolved from the credential, never from the body.
  • Authorization through OpenFGA and OPA decisions; every mutation and decision writes a hash-chained eai.audit_events row.
  • Secrets never returned by the API; TLS everywhere; Cilium network policies restrict who can reach the service.

Observability​

  • Metrics: eai_policy_enforcement_requests_total, eai_policy_enforcement_errors_total, eai_policy_enforcement_latency_seconds (Prometheus).
  • Traces: OpenTelemetry spans eai.policies.* with W3C traceparent propagation, AI spans forwarded to Opik.
  • Audit actions: policy.create, policy.update, policy.delete, policy.simulate, policy.evaluate.

FinOps aspects​

Operating cost is allocated per tenant and project through labels on Usage Events and Kubernetes resource requests; no direct per-call cost.

Failure modes and resilience​

  • Stateless replicas behind the API Gateway, PostgreSQL HA for state; readiness probe GET /readyz removes unhealthy pods.
  • External system unavailable: fail closed for security decisions, explicit error code, no silent bypass.

Standalone adoption (client of a client)​

A client of a client can adopt this brick alone with the Python SDK sub-client client.policies (TS eai.policies, Java client.policies(), Go client.Policies). Minimal deployment: Control Plane API + PostgreSQL + Keycloak (or API keys), the Control Plane loads every domain of services/control-plane/src/eai/domains; the optional chart components are switched off in deploy/helm/enterprise-ai/values.yaml (vllm.enabled, qdrant.enabled, nats.enabled, workers.enabled).

Acceptance tests​

  1. A tenant cannot read or modify another tenant's resources (RLS test).
  2. Every mutation produces an audit event verifiable by GET /v1/audit/verify.
  3. Errors are returned in English and French according to Accept-Language.

Evidence on real components​

See the identity and policy plane guide: components started from the official releases (tools/iam/fetch.sh), tests services/control-plane/tests/test_iam_*.py.