Security
Defense in depth, layer after layer
Defense in depth, from the gateway to the network
Platform
A single Control Plane for all of your organization's AI
Navin AI Platform gathers registries, policies, quotas, prices and audit in one place, and connects specialized runtimes and gateways for models, agents, tools, data and media.
At a glance
- One source of truth for governance
- Mandatory gateways for every capability
- Unified telemetry on every call
Architecture
Eight functional domains, 112 documented bricks
Each brick has a precise role, a documented API contract and tests that prove its behavior.
| Domain | What it covers | Bricks |
|---|---|---|
| A -Governance, identity and security | Portal, Control Plane API, human and machine identities, authorization, policy engine, secrets, multi-tenancy, governance registry, approvals, risk and incidents. | 14 |
| B -LLM management and Model Gateway | Unified LLM proxy, local vLLM inference, provider and model registries, routing, reasoning effort, token accounting, pricing, evaluation and provider failover. | 14 |
| C -Agent runtime and execution | Navin runtime, durable execution, sub-agents, agent to agent, sessions, scheduling, event triggers, human in the loop, sandbox, kill switch and replay. | 15 |
| D -Capability and integration gateways | Tool and MCP registries and gateways, skills, plugins, connectors, credential broker, webhooks, channels and API Gateway. | 14 |
| E -Data, privacy and knowledge | Classification, DLP, tokenization, encryption, document processing, RAG, vector database, context, memory, lineage, retention and object storage. | 13 |
| F -Multimodal | Vision, image and video generation, speech recognition and synthesis, diarization, real-time voice, multimodal DLP and media processing. | 12 |
| G -Observability, quality and audit | Distributed and AI tracing, telemetry, analytics, metrics, logs, dashboards, alerts, evaluation, red team, audit evidence and security monitoring. | 14 |
| H -FinOps and sovereign infrastructure | Quotas, cost ledger, pricing, GPU accounting, autoscaling, Kubernetes, networking, GitOps, IaC, admission, image scanning, SBOM, signing, backup and artifact registry. | 16 |
Request flow
The journey of a request through the platform
Whatever the capability called, a request follows the same path and leaves the same evidence.
- 01
Application or agent
Authenticated by Keycloak or an API key, SPIFFE machine identity
- 02
APISIX gateway
Coraza WAF and OWASP CRS, size and rate limits
- 03
Control Plane
Tenant, project and environment resolved, RBAC and RLS
- 04
OPA policy
Allow, deny or request an approval
- 05
Specialized gateway
Models, tools, MCP, knowledge, data or multimodal
- 06
Evidence
OpenTelemetry span, Usage Event and chained audit
Principles
Five non-negotiable principles
01 - A single Control Plane
The one source of truth for registries, policies, quotas, prices and audit.
02 - Specialized runtimes
Agents, real-time voice, batch and media processing, periodic tasks and inference scale separately. No runtime holds governance data.
03 - Mandatory gateways
Models, tools, MCP, knowledge, data and multimodal are only reachable through their gateway. Agents never hold a provider key.
04 - Unified telemetry
Every call carries a W3C traceparent and produces OpenTelemetry spans, a Usage Event and a hash-chained audit event.
05 - Security enforced by the infrastructure
SDKs enforce contracts, but gateways, Cilium network policies and SPIFFE and Keycloak identities actually enforce security. Bypassing an SDK grants no extra access.
Multi-tenancy
A multi-tenant model, from the platform to the environment
Every request is attached to a tenant, a project and an environment before any processing.
- 01
Platform
The operator and its administrators: global policies, providers, prices, quota ceilings.
- 02
Tenant
A customer or an entity: its own identity realm or federation, quotas, policies, providers and keys.
- 03
Project
A team or an application, selected by the X-Project header: agents, tools, MCP, skills and rules.
- 04
Environment
dev, test, staging or prod, selected by the X-Environment header.
Products
Three products, one platform
Each product ships as system packages and fits into your usual operations tooling.
| Product | Role | Delivery |
|---|---|---|
| Navin AI Platform | The Control Plane API, the workers and the portal: where models, agents, tools and data run. | Helm chart, DEB, RPM and pacman packages |
| Navin Manager | The operations console: installs, configures and runs the platform services, hosts and clusters, with high availability declared per service. | DEB, RPM and pacman packages |
| Navin Manager Agent | The agent installed on every node of a cluster, which carries out the operations requested by the console. | Debian, Ubuntu, RHEL, Rocky, Alma and Arch Linux |
Capabilities
Explore the platform capabilities
Six capabilities, enforced on every call.
Governance
Rules enforced by the platform, on every call
Policies, approvals and registriesTraceability
Prove what every agent did, and why
Chained audit, traces and lineageScalability
From the first pilot to production at scale
Autoscaling, quotas and high availabilityAI agents
AI agents that act, under control
Durable runtime, tools and isolated MCPSovereign deployment
Your AI, on your infrastructure, under your rules
On premises, air-gapped or hybrid
See the platform on your own use cases
A session with an architect to walk through the architecture, the controls and the right topology for your organization.