v1.0.0: The Enterprise AI Security Mesh

We are proud to announce the v1.0.0 General Availability release of the AIL Enterprise Gateway.

As AI agents transition from read-only chatbots to autonomous actors capable of executing database queries, provisioning cloud infrastructure, and deploying code, relying on probabilistic LLM system prompts for security is no longer viable. Prompt injection and hallucination are mathematical realities of the current architecture.

AIL v1.0.0 solves this by moving AI security out-of-band. We have built a mathematically verifiable, zero-trust security mesh that intercepts agent actions at the network layer, enforces deterministic policies (SOC2, GDPR, FinOps), and cryptographically logs every decision to an immutable ledger.

If the LLM hallucinates, it fails closed. If the prompt is injected, it fails closed. Security is no longer up to the AI.

🛡️ Core Architecture & Capabilities

• Deterministic Out-of-Band Interception: Agents do not talk to your infrastructure. They talk to an Envoy proxy sidecar over an mTLS mesh. Envoy intercepts the payload and pauses execution.
• Open Policy Agent (OPA) Integration: Every payload is evaluated against strict, typed Pydantic schemas and Rego policy frameworks (SOC2, GDPR, HIPAA, FinOps).
• Cryptographic Workload Identity: Built natively on SPIFFE/SPIRE. Agent containers are mathematically verified and issued short-lived SVIDs before they can join the mesh. No static API keys to steal.
• True SaaS Multi-Tenancy: The FastAPI Control Plane dynamically compiles and serves isolated legal brains to the OPA sidecars based on AIL_TENANT_ID. Finance and Marketing can use the exact same agent codebase while bound by completely different compliance guardrails.
• Immutable Audit Ledger: Every agent request, OPA decision, and policy bundle SHA-256 hash is permanently recorded to an ImmuDB ledger. If an auditor asks why an agent acted, you have cryptographic proof.

☸️ Enterprise Kubernetes Native

v1.0.0 introduces full Kubernetes support via the official AIL Helm Chart.

• The Sidecar Pattern: Agent, Envoy, and OPA run in a single shared-localhost Pod namespace, preventing node-level network sniffing.
• K8s PSAT Attestation: Native SPIRE integration using Kubernetes Projected Service Account Tokens.
• Deploy in 3 Commands:

# 1. Pull the SPIRE identity mesh dependencies
helm dependency update charts/ail-gateway/

# 2. Deploy the zero-trust gateway, control plane, and ledger
helm install ail-gateway charts/ail-gateway -n ail-system --create-namespace \
  --set secrets.openaiApiKey="YOUR_OPENAI_KEY" \
  --set secrets.immudb.password="immudb"

# 3. Verify the cryptographic identity mesh is running
kubectl get pods -n ail-system -w

📊 Observability & Control Plane

• Next.js CISO Dashboard: Manage multi-tenant policies, toggle compliance frameworks, and search the immutable audit ledger in real-time.
• Prometheus & Grafana: Full telemetry integration tracking intercept latencies, tool usage, and policy denial spikes.

What's Next (v1.1.0 Roadmap)

• High Availability (HA) Control Plane scaling via PostgreSQL state backend.
• Cross-cluster identity federation (OIDC).
• Real-time policy hot-reloading without container restarts.

Get Started: Check out the Quickstart Guide to boot the multi-tenant architecture locally or in your Kubernetes cluster today.