Architecture
A data plane that decides. A control plane that proves.
The token path and the governance machinery are separate systems on purpose: enforcement must be fast and always up; signing, grading, and posture can be thorough and slightly behind. The proxy keeps enforcing even when the engine is down.
AnchorProxy
GoData plane
An OpenAI-compatible proxy on the token path. Evaluates the compiled policy bundle, redacts PII inline, guards MCP tool calls, forwards to OpenAI, Anthropic, or any OpenAI-compatible server (Ollama, vLLM) with fallback routing — and spools decision traces durably when the engine is unreachable.
AnchorEngine
Python · FastAPIControl plane
Everything expensive, off the request path: compiles the policy DSL, signs decision events with ECDSA P-256, grades them on the evidence maturity model, computes compliance posture across frameworks, scores risk on a 5×5 matrix, and ingests egress logs for shadow-AI discovery.
AnchorUI
Next.jsGovernance dashboard
Four views: global posture with asset topology and risk heatmap, a live decision stream over WebSocket, a no-code policy editor that emits the exact DSL, and an audit hub for verifying records and exporting Trust Packets. Admin and read-only auditor roles.
The request pipeline
What happens in those 50 milliseconds
Every request through the gate walks the same ordered pipeline. The budgets are regression-gated in CI: under 20ms of added overhead for telemetry, under 50ms for inline enforcement.
- 01
Prebind policy evaluation
The compiled bundle — including quarantine rules synthesized from high-band risks — runs against the request before anything else. Refused means refused here, not logged later.
- 02
Inline PII redaction
Detectors for SSNs, emails, card numbers (Luhn-validated), and phone numbers rewrite the payload before egress. A pluggable classifier hook is defined for ML-based detection.
- 03
Prompt cache
Exact-match cache keyed on a SHA-256 of the normalized request — deterministic (temperature 0), non-streaming requests only, so a cache hit is provably the same answer.
- 04
Provider forward
Translated to the upstream provider’s format, with configurable fallback routing on upstream failure.
- 05
Async trace emission
The decision event is appended to a durable local spool and flushed to the engine with retry — at-least-once, never blocking the response.
Telemetry is fail-open — the proxy keeps serving and spools traces locally when the engine is unreachable. Policy in full mode is fail-closed — no evaluation, no egress.
Interception modes
Three ways into the path
full default Inline blocking and payload editing. Clients point their base URL at the proxy. Fail-closed: if policy can’t be evaluated, the request doesn’t go through.
verify observe-only Never blocks. The SDK pushes async traces for audit while you build confidence in your policy set — the honest on-ramp before you turn enforcement on.
dns-redirect estate-wide Egress DNS redirect brings unmanaged clients through the gate and powers shadow detection. Requires a client-trusted proxy CA.
Where it fits
Keep your router. Add a governor.
Already run a gateway for routing and failover? Keep it. AnchorProxy is OpenAI-compatible on both sides, so it chains in front of it or behind it — your gateway does the routing, AnchorGate does the governing. We don’t compete on routing benchmarks, and we won’t pretend to. Here’s the difference in kind:
Routing-focused gateways
Built to optimize the request path — routing, failover, caching. Governance is a plugin.
AnchorGate
Built to govern the request path. Deterministic policy in the hot path, fail-closed when it can’t decide.
Routing-focused gateways
Guardrails as best-effort filters — often another model judging the traffic, often fail-open under load.
AnchorGate
A compiled policy DSL, human-approved before it activates. The same input always gets the same verdict, under 50ms.
Routing-focused gateways
Logs and traces you can read — mutable rows you have to trust.
AnchorGate
ECDSA P-256-signed decision events in an append-only ledger, exportable as a Trust Packet your auditor verifies offline.
Routing-focused gateways
MCP is one more protocol to proxy through.
AnchorGate
MCP is an attack surface: exact-string allowlists, shell invocations rejected, single-use task-bound tokens.
DES & DEMM
One schema, graded evidence
The Decision Event Schema is a single JSON Schema from which the Pydantic, TypeScript, and Go types are generated — drift-checked in CI, so the three components can’t quietly disagree about what a decision record is. Each record is then graded on the Decision Evidence Maturity Model, a cumulative ladder tying audit questions to record properties:
- L1 Ad-hoc
- Something was logged, somewhere.
- L2 Traceable
- Actor, action, and target are on the record.
- L3 Governed
- The policy that applied — and its version — is on the record.
- L4 Accountable
- The deciding authority and verdict rationale are on the record.
- L5 Reconstructable
- The full decision replays from the record alone: who, what, which policy, what was touched, and why.
A quarterly screenshot never leaves L1. Every record AnchorGate signs is built to answer an auditor’s who / what / which policy / why — that’s what L5 means.
Governance & evidence
Evidence that survives the question “says who?”
One export: a manifest of scope and thresholds, the signing public key, and every decision event with its exact canonical payload and signature. Your auditor re-verifies each record offline — against the key, not against our word. If a byte changed anywhere, verification fails. Every record maps onto EU AI Act, ISO/IEC 42001, and SOC 2 control catalogues.
- No dashboard access required — the packet is self-contained.
- Signatures cover a stored canonical payload, so verification never depends on database round-tripping.
- Each record carries its DEMM grade: how far up the ladder from “screenshot” to “reconstructable” it stands.
FAQ
Architecture questions
- What happens when the control plane goes down?
- The proxy keeps serving with the last compiled policy bundle and spools decision traces to a durable local log, flushing them with retry once the engine returns — telemetry is fail-open, at-least-once. Policy enforcement in full mode is the opposite: fail-closed. If the gate cannot evaluate policy, it refuses rather than waves traffic through.
- How is this different from a guardrails library?
- A guardrails library runs inside one application, and only in the applications someone remembered to instrument. AnchorGate is infrastructure: it sits at the network boundary, covers every app that routes through it — including the shadow systems it discovers from egress logs — and produces something no library does: cryptographically signed decision evidence mapped to compliance frameworks.
- Is AnchorGate an AI gateway?
- Yes, in the sense that matters for integration: AnchorProxy is an OpenAI-compatible gateway — a base-URL change puts it inline in your LLM and agent traffic. But it is built to govern that traffic, not to optimize it. Most AI gateways compete on routing, caching, and latency; AnchorGate competes on what happens to a request while it is in flight — deterministic policy enforcement, PII redaction, MCP tool-call security — and on the signed evidence it leaves behind.
- Can I run it alongside an existing AI gateway or LLM router?
- Yes, and you probably should. AnchorProxy speaks OpenAI-compatible on both sides, so it composes: point your apps at AnchorGate with your gateway as its upstream, or have your gateway forward through AnchorGate. Either way, every request crosses the policy gate and lands in the signed ledger. AnchorGate keeps its routing deliberately simple — configurable fallback between upstreams, nothing more. Load-aware routing, semantic caching, and cost-optimized model selection are your gateway’s job, and we would rather say so than half-build them.
The architecture is public. So is the code.
Every claim on this page is checkable against the repository — the pipeline, the budgets, the schema, the signing. That’s the standard we think governance tooling should be held to.
Read the sourceor email hello@anchorgate.ai