Skip to content
FaradAiLab Docs
Enterprise Beta

Centralized Control Plane & Multi-Tenancy

The FaradAiLab Enterprise Edition Central Control Plane serves as the central administrative and observability hub for your organization’s entire AI agent ecosystem. Hosted at wire.faradailab.com (or deployed as a dedicated VPC instance), it provides real-time fleet health monitoring, dynamic policy bundle compilation, and cryptographic tenant partitioning.

graph TD
    subgraph ControlPlaneArch ["Control Plane Internal Architecture"]
        API["Admin REST & GraphQL Gateways\n(Port 443 / TLS 1.3)"]
        SyncHub["mTLS Fleet Sync Hub\n(gRPC / WebSocket Server)"]
        BundleCompiler["OPA Rego Bundle Compiler\n(Wasm / Tarball Pipeline)"]


        subgraph DataTier ["Cryptographic Data Tier"]
            Postgres["PostgreSQL Cluster with RLS\n(Strict Tenant Isolation)"]
            KMSAdapter["KMS BYOK Cryptographic Layer\n(AWS KMS / GCP / Vault)"]
            TimescaleDB["Distributed Time-Series Audit Store\n(Tamper-Evident Hash Chain)"]
        end


        API --> Postgres
        SyncHub --> TimescaleDB
        SyncHub --> BundleCompiler
        TimescaleDB --- KMSAdapter
        Postgres --- KMSAdapter
    end


    EdgeProxies["Distributed Agent Fleets\n(Developer Laptops & CI/CD)"] -->|"mTLS (Port 8443)"| SyncHub
    SecAdmin["Enterprise Security Admin"] -->|"SAML 2.0 / HTTPS"| API

Multi-Tenant Architecture & PostgreSQL RLS

In enterprise environments, strong data isolation is paramount. FaradAiLab Enterprise Edition utilizes PostgreSQL Row-Level Security (RLS) combined with application-level tenant context injection to guarantee that no tenant or workspace can ever view, query, or mutate another organization’s policies, fleet nodes, or telemetry.

Tenant Context Isolation

Every database connection is tagged with a session-scoped tenant identifier verified from the authenticated JWT or mTLS client certificate before any SQL query executes:

-- Executed automatically on every pooled connection before transaction handling
SET LOCAL app.current_tenant_id = 'tenant_corp_748291';
SET LOCAL app.current_workspace_id = 'ws_engineering_core';

Enforced RLS Policies

All core tables (agent_nodes, policy_bundles, audit_records, dlp_vault) enforce hardware-level isolation policies in the database engine:

-- Example Row-Level Security policy for fleet nodes
ALTER TABLE agent_nodes ENABLE ROW LEVEL SECURITY;


CREATE POLICY tenant_isolation_policy ON agent_nodes
    FOR ALL
    USING (tenant_id = current_setting('app.current_tenant_id')::uuid)
    WITH CHECK (tenant_id = current_setting('app.current_tenant_id')::uuid);

[!IMPORTANT] Even in the catastrophic event of an SQL injection vulnerability in an administrative endpoint, PostgreSQL’s kernel-level RLS prevents queries from reading across tenant boundaries.

Fleet Node State Machine & Heartbeat Protocol

Each edge FaradAiWire instance running on a developer machine or CI container reports periodic health heartbeats to the control plane over an encrypted mutual TLS stream.

stateDiagram-v2
    [*] --> Enrolled: Token Verification
    Enrolled --> Active: Initial mTLS Handshake & Policy Sync
    Active --> Active: Heartbeat OK (Every 30s)
    Active --> Degraded: Heartbeat Missed (>90s)
    Degraded --> Active: Heartbeat Resumed & State Re-synced
    Degraded --> Offline: Inactive (>15m)
    Active --> Quarantined: Policy Violation / Tamper Alert
    Quarantined --> [*]: Revoke Client Certificate

Heartbeat Payload Schema

Edge nodes periodically send compressed, signed telemetry packets:

{
  "node_id": "node_mac_a8f94b120",
  "tenant_id": "tenant_corp_748291",
  "faw_version": "v1.4.2",
  "active_policy_hash": "sha256:8f43a91c0b39...",
  "daemon_uptime_seconds": 18420,
  "metrics": {
    "requests_processed": 1420,
    "fast_path_avg_latency_ms": 0.42,
    "blocked_violations": 3
  },
  "timestamp": "2026-10-31T17:45:00Z"
}

Version Drift & Compliance Auditing

The Control Plane continuously compares active_policy_hash against the latest signed organizational bundle. If a developer’s workstation drops out of compliance (e.g. running an outdated policy version or an unapproved proxy build), the dashboard flags the device and can trigger automated quarantine workflows.

Workspace Scoping for Distributed Teams

Large enterprises require fine-grained segmentation across engineering groups. FaradAiLab Enterprise Edition allows administrators to create hierarchical Workspaces:

  • Core Platform Team: Unrestricted local tool execution with relaxed schema checks on dev clusters.
  • Fintech / Payment Engineering: Strict DLP masking for PCI-DSS cards and account numbers; mandatory Human-In-The-Loop (HITL) authorization for all SQL tool mutations.
  • Autonomous CI/CD Runners: Zero file system escape; restricted to ephemeral workspace mounts with hard execution timeouts.

Each workspace maintains its own OPA bundle branch, dedicated KMS sub-key, and designated SIEM output streams.

Next Steps