Architecture

One control plane. Three planes of work.

The control plane holds identities, the agent graph and policies. The runtime plane authenticates, authorizes and enforces on every governed call. The evidence plane records each decision in a signed, hash-chained trail you can verify offline.

The system

Three planes, one path through them

Control plane

What you configure, once.

  • Identity
  • Agent Graph
  • Policies
  • Configuration

Runtime plane

What happens on every governed call.

  • Authentication
  • Authorization
  • Policy Evaluation
  • Approval
  • Enforcement

Evidence plane

What you hand to an auditor.

  • Events
  • Decisions
  • Hash Chain
  • Signatures
  • Export

Praesidia sits on the connection between your agents and everything they reach, so nothing has to be rewritten to be governed.

For security review

How it answers the questions reviewers ask

Where data flows
Agent traffic routed through Praesidia reaches the runtime plane first: which agent is asking, whether the tool is permitted on that connection, and what the arguments actually say. Traffic that bypasses the platform is neither inspected nor recorded.
What gets stored
Every governed request, response, and policy decision is recorded in an append-only log, along with the agent graph, the connections and the policies you configure.
Credentials
Each agent authenticates with its own attributable, individually revocable credential, and gets short-lived capability credentials for work it performs. Provider keys and agent credentials are vaulted — shown once, never exposed in logs or read back in plaintext.
Tenant isolation
Every request is scoped to your organization, with row-level security on the most sensitive data, so one organization can never read another's.
Failure behaviour

Fail-closed is the default: if the enforcement point cannot reach the control plane, governed calls are refused. Operators can turn on a bounded, time-boxed fail-open window instead; requests served while degraded are spooled durably and replayed into the audit chain.

Cached policy bounds how long a revoked key could keep working — minutes rather than hours, and you can shorten it.

Latency
Calls to the control plane time out at 5 s and 7 s rather than hanging. Measured proxy overhead is p50 0.332 ms · p90 0.927 ms · p99 3.39 ms, from our own release measurement under the conditions it states — see the measurement and its caveats.
Retention
Retention periods are set per plan and confirmed during evaluation; ask security@praesidia.ai via the Trust Center.
Encryption
Encryption in transit and at rest. Audit records are signed and hash-chained under the default configuration, which an operator can turn off; regulated deployments hold their own signing key (BYOK), and external anchoring to the public Sigstore Rekor transparency log is opt-in.

Then: runtime enforcement · the agent graph · verify the evidence yourself.

Everything a security review asks for, on one page

Control status, hosting and data location, attestations, and the security contact.