How Agentycs fits together.
One control plane, declared as Kubernetes resources, reconciles everything above it: the lakehouse that holds your data, the plane that serves your models, the runtime your applications live in, the network that reaches them, and the factory that builds it all.
Five layers #
Read from the bottom if you are evaluating where the platform can run, and from the top if you are deciding what to code against. Each layer depends only on the one beneath it, and each is declared rather than assembled by hand, so nothing above the infrastructure layer needs to know which datacentre, cloud account or disconnected site it happens to be running in.
- 05
Interfaces #
What your code talks to. Standard protocols in front of everything below, so existing clients, drivers and agents connect unchanged. These are the same eight surfaces the developer overview names, in the same order.
- OpenAI-compatible API
- PostgreSQL wire protocol
- Arrow Flight SQL
- Graph queries
- REST, WebSocket and MCP
- Application Framework
- Connectors and federation
- Identity and tokens
In: a request from your client, carrying a credential. Out: the answer, and a request id you can quote.
- 04
Applications #
First-party products and the framework you build your own with, sharing one workspace shell, navigation and design system.
- Application Framework
- Conversation
- Data explorer and documents
- Model and inference console
- Workspace and instance administration
In: an authorised operation, already scoped to a workspace. Out: rows, documents, a stream of diffs, or a declared side effect.
- 03
Data, intelligence and delivery #
The three engines that make the platform worth building on: where data lives and is understood, how models are served, and how software is built.
- Atom: lakehouse, hybrid search, data intelligence, data science
- Anima: model serving, orchestration, accelerator fleet, private model hub
- Agent² Software Factory: autonomous design, planning, implementation and release
In: a planned query or a generation request. Out: filtered results, generated tokens, and an audit record of both.
- 02
Platform foundation #
The always-on substrate every application runs on. Routing, identity, live data, durable workflows, the database and observability.
- App gateway and app runtime
- Identity, tokens and one authorisation decision
- Live query engine and realtime gateway
- Durable workflow engine
- Distributed transactional database and change streaming
- Metrics, dashboards, alerts and tracing
- Workspace isolation
In: an authenticated caller. Out: one authorisation decision, a bounded deadline and a classified failure if it comes to that.
- 01
Infrastructure #
Hardware, Kubernetes, storage and network. The same platform sits on all of it, which is what makes managed, private, on-premises, edge and air-gapped the same product.
- Apex AI servers, or your own hardware or cloud instances
- Kubernetes, with the platform reconciled from custom resources
- Sovereign S3-compatible object storage with geo-replication
- Cloud Mesh: edge gateway, distributed DNS, zero-trust networking
- Secrets vault and brokered secret access
In: a declaration of what should exist. Out: accelerators, storage, private names and routes that actually exist, and stay that way.
How one request travels #
A layer diagram tells you what exists. This tells you what happens, in order, to a single call arriving from your code. The two boundaries marked below are the ones that decide whether anything else on this page matters.
-
It arrives at the platform's own edge #
The edge gateway terminates the connection and matches the request to an instance and a hostname that instance is permitted to serve. Public routing is published by the platform itself rather than by a provider you did not choose.
-
An identity is established inside the boundary #
A session cookie or bearer credential is validated by the platform, and the workspace the request belongs to is derived from that validated state. Not from a header, not from a hostname, not from anything the caller can assert.
Trust boundary. Everything after this point runs as a known identity in a known workspace.
-
Authorisation resolves once #
Role, capability and attribute rules collapse into a single audited decision before any work is dispatched. Adding a protocol adds a caller, never a second policy engine, which is why REST, SQL, a socket frame and a tool call cannot disagree about what you may do.
-
The gateway forwards it, with a deadline #
Circuit-breaking, an explicit timeout and request-id propagation belong to the gateway rather than to each application. If it fails here, the failure is classified so your client knows whether to retry.
-
Execution applies the filters #
Row filters and column masks are part of query execution, not a layer in front of it, so a direct driver connection cannot step around them. Generated queries are read-only and bounded by default, exactly like hand-written ones.
Trust boundary. Below this line the data itself is the thing being protected, and the protection travels with the query.
-
The answer comes back, or keeps coming back #
Analytical results stream as record batches under a terminal contract. Live queries return the current answer once and then only the diffs, over server-sent events or the realtime socket.
-
The access is recorded #
Reads and privileged actions land in a redacted audit record correlated to the identity, the session and the query behind them, held inside the instance and exportable to you.
What fails, and what keeps working #
Resilience claims are worth as little as the failures they decline to mention, so here are both halves.
What the platform absorbs #
An accelerator node is lost
Placement reschedules the models it held onto hardware whose architecture supports them, and requests route to workers that are already serving. Capacity drops; service does not stop.
A site is lost, in a multi-site instance
Load-balanced DNS and edge routing move traffic to a healthy site, and object storage carries on from the zones that remain. You lose the capacity of that site rather than the service.
The link to the core is lost, at an edge site
The site keeps serving the models it has already mirrored, under the same tenant policy, and reconciles what it was actually running when the link returns.
The external network is lost, in a sealed instance
Nothing changes, because there was never a dependency on one. Weights, secrets, name resolution, the registry and the audit ledger all resolve inside the boundary.
What is genuinely shared #
Identity, authorisation and the audit path are shared services. They are replicated within an instance, but they are one logical decision point by design, and that is the point of them. An instance that cannot authenticate should not serve, however healthy the accelerators are.
A cold start is still a cold start. The first request for a model that is not yet resident waits for weights to load from the local artefact store. There is no upstream to wait on, which is the part that matters, but it is not instant.
Capacity is finite in every pattern. A site serves the models it holds and the accelerators it has. Surviving the loss of one location requires real spare capacity in another, and a two-site instance running full is not resilient.
True at every layer #
These are the properties that make the layers add up to a platform rather than a stack of components. They are worth knowing before you design against any single interface.
Declared, not deployed by hand #
Clusters, workspaces, applications, databases, models and network routes are all custom resources. An operator reconciles what is declared into what is running, so recovery and reproduction are the same operation.
One authorisation decision #
Role, capability and attribute rules collapse into a single audited decision. Adding a protocol adds a caller, never a second policy engine.
Isolation by construction #
Every service derives workspace scope server-side from validated credentials, and shared services cannot read or write across the boundary even when they hold the connection.
Change is a stream #
Every committed change fans out over the messaging fabric. Live queries, search indexes and downstream consumers all read that one feed instead of polling.
Durable by default #
Long-running work lives in workflows that replay from their last committed state after any restart, with side effects that commit exactly once.
Observable as shipped scope #
Metrics, dashboards, alerts and traces are part of a feature rather than a follow-up, and are versioned with the platform that emits them.
Correct across sites #
Cluster-local messaging and wide-area links have different correctness assumptions. Cross-site control travels over authenticated, signed links that tolerate flaky connectivity.
No external runtime dependency #
Model weights, artefacts, secrets, DNS and ingress are all owned by the platform, so a fully disconnected instance keeps serving.
The platform builds itself #
Agentycs is delivered by the same autonomous factory it offers its customers. Product intent goes in as plain language; agents do the design, the architecture review, the planning, the implementation and the release, and every stage is gated by automated verification rather than by anyone's judgement about whether it looks finished.
Intent to specification
Requests are captured with their business context, the genuine product forks are put to a human, and the result is a structured brief with acceptance criteria.
Design and architecture
Independent agents propose competing approaches, an adversarial panel scores them for correctness, security and blast radius, and the winning design is recorded as a decision record.
Plan and dispatch
The design is decomposed into a dependency-ordered plan, validated on every write, and projected onto a board that hands each agent the next genuinely unblocked task.
Build and verify
Agents work in isolated workspaces. Static checks, tests, adversarial review and live tests against real deployments each gate the work, and a green result is required rather than optional.
Release and learn
Promotion is GitOps-driven and observed, with canary rollout and automatic rollback. Production signals and live-test regressions come back in as new work without anyone filing them.