Runs where your data already lives.
One deployable service, three topologies. Start with a single Compose host, move to a Kubernetes cluster when traffic warrants it, and run entirely offline if your network demands it.
Pick the shape that matches your estate.
The same application runs in all three. Scaling out changes where state lives, not what the product does.
Evaluation and small production
Single host
One Compose stack on one machine. Everything the gateway needs runs beside it.
- Docker Compose profiles from lite through full, installed by one script
- Bundled PostgreSQL for the system of record
- In-JVM rate-limit counters — no external cache required
- Optional bundled Keycloak for administrator SSO
- Suitable for evaluation, pilots, and single-instance production
Scale-out production
Multi-replica cluster
A Helm chart deploys several application replicas behind your load balancer with shared runtime state.
- Kubernetes deployment with horizontal autoscaling
- Valkey-backed rate limiting so counters hold cluster-wide, not per pod
- Configuration changes propagated to every replica by pub/sub
- External managed PostgreSQL and OpenSearch supported
- Scheduled maintenance runs as a cluster singleton, never duplicated
Isolated networks
Air-gapped
No outbound internet dependency for installation or operation, provided your models are reachable.
- Offline installation from pre-pulled images
- Self-hosted model backends such as Ollama and vLLM registered as providers
- No licence phone-home or telemetry requirement in the request path
- Snapshots and archives written to storage you control
One required dependency. The rest is opt-in.
A minimal install is the application and a database. Every other component earns its place only when you turn on the capability that needs it.
Holds keys, catalog, budgets, guardrail configuration, directory, and the partitioned audit trail. Required.
Backs rate-limit windows and configuration broadcast across replicas. Optional — single-instance deployments use in-JVM counters.
Indexes normalized governance events for search, detections, and analytics, with ISM retention and snapshots. Optional and off by default.
Optional identity provider for the admin plane. HTTP Basic break-glass access remains available either way.
One command to a running gateway.
The installer provisions the stack, runs migrations, and brings up the console. Configuration and provider registration happen afterwards, in the dashboard or over the admin API.
# Linux / macOS curl -fsSL https://agentaccessmanager.com/get.sh | sh # Windows PowerShell irm https://agentaccessmanager.com/get.ps1 | iex # Kubernetes helm install aimanager ./deploy/helm/aimanager
docs.agentaccessmanager.com/install.htmlBuilt to be run by a platform team.
The operations manual — configuration reference, backup, retention, and reset procedures — is in the documentation.
Size it for your traffic.
Tell us your request volume, provider mix, replica requirements, and identity stack, and we will come back with a concrete deployment architecture.
We typically respond within one business day.