Skip to main content
Enterprise customers get hard tenancy boundaries across Environments, the Control plane, Evaluation, and Expert Review. Isolation is enforced in the control planes, not left to agent or expert goodwill.

​
How isolation is enforced

Every credential binds to exactly one org, and identity is set server-side from that credential, never from a request body. A shared control layer resolves each request to its org before anything else runs, and all resources behind it (environment sessions, policy packs, permits, evidence feeds) are partitioned per org. Your agents can only reach your tenant, because there is no request shape that names another one. This is logical isolation with scoped credentials and per-org partitions. When a regulator or data classification requires a physical boundary instead, the self-hosted deployment model moves the gateway and evidence store inside your own network.

​
Shared assets

Akhara maintains central, versioned repos of reusable assets: a policy bank of baseline packs (for example pci-0), shared environments, and shared VU-* verifiers. Your tenant imports a pinned version of what it needs, and that copy runs entirely under your org’s scope, alongside any private policies, environments, and verifiers you layer on top. Distribution is one way: definitions flow from the shared bank into tenants, but runtime state, evidence, and data never flow back into the bank or across to another tenant. Upgrading to a newer baseline version is an explicit change in your tenant, not something the shared repo pushes into a running workspace.

​
Isolation bar

​
Soft quotas (illustrative)

Exact numbers come from your workspace contract and live usage meters. Soft quotas throttle and queue; they do not silently share capacity across orgs.

​
Defaults

  • Public surface: Eval API (agi.akhara.ai), Control plane PDP (api.akhara.dev), and documented consoles only. Orchestrators, workers, and device pools stay on the private network.
  • Auth: Org-scoped API keys (and SSO/SAML for enterprise). Keys never authorize cross-tenant reads.
  • Episode isolation: Each Environments run gets an isolated backend session and device assignment for that episode; teardown drops state.
  • Control plane: Fail-closed PEP; PDP never executes customer tools; evidence feed is org-partitioned.
  • Expert Review: Experts see only assigned packs; briefs and fixtures stay in-org; no export of other customers’ content.
  • Egress: Environment and sandbox egress follow an allowlist on enterprise plans; trial may be open for bring-up.
  • Residency: Enterprise can pin region (for example US or EU). Trial defaults to the primary US region.
  • Audit: Admin and policy decisions are attributable to an org + principal; retention follows the table above.

​
What we do not do

  • Share device pools or catalogs across orgs in a way that exposes another tenant’s state
  • Return another org’s trajectories, permits, or expert labels from any public API
  • Let agents or experts choose their own tenant id in a request body