Azure / AWS / GCP / On-Prem
Native
OTel
Native
CMK
Supported
OIDC / SAML / SCIM
Native
The diagram

The xyner.ai reference architecture

Five clean layers — autonomy, reasoning, governance, integrations and runtime — with a separated control and data plane underneath.

xyner.ai reference architecture — autonomy, reasoning, governance, integrations and runtime layers

Every layer is independently deployable, observable and replaceable. Customers can host the data plane in their own VPC while the control plane is managed — or run the full stack on-prem.

Request lifecycle

What happens when an agent runs

From the moment a goal arrives until the audited result lands — every request flows through the same nine guarded stages.

1

Ingest

Goal arrives via chat, API, webhook, schedule or event stream.

2

Authenticate

OIDC / SAML identity; SCIM groups and RBAC scopes resolved.

3

Parse intent

Classifier routes to the right agent team and skill profile.

4

Plan

Reasoning engine builds a typed task graph with dependencies.

5

Authorize

Policy engine evaluates tool, data and approval requirements.

6

Execute

Agents call tools and APIs; verifiers score intermediate outputs.

7

Approve

Human gates triggered when confidence is low or impact is high.

8

Commit

Final actions write to systems of record with idempotency.

Deployment topologies

Pick the topology that fits your environment

Five battle-tested deployment patterns covering everything from public cloud to fully air-gapped sovereign sites.

Multi-tenant SaaS

Both planes managed by xyner. Fastest path to value. Region-pinned, CMK-encrypted, isolated tenants.

Best for: pilots, mid-market, public web workflows

Dedicated VPC

Single-tenant data plane in your AWS / Azure / GCP account. Control plane stays managed for ops simplicity.

Best for: regulated industries with cloud strategies

Hybrid

Control plane managed; data plane runs in your VPC or on-prem. Sensitive data never leaves your perimeter.

Best for: banks, insurers, healthcare

Self-managed on-prem

Full stack on your Kubernetes. Air-gappable upgrades. You own everything; we provide images and support.

Best for: defense, government, ultra-regulated

Sovereign cloud

Deployed inside national-sovereign cloud providers (UAE, KSA, EU). Data residency by jurisdiction.

Best for: ministries, regulators, GCC public sector

Edge runtime

Lightweight agent runtime at the branch, plant or field site. Syncs to central control plane.

Best for: manufacturing, retail, utilities

Security architecture

Defense in depth, by design

Identity, network, runtime, model and data — every layer has its own controls. Nothing relies on the model behaving.

Identity & access

  • OIDC / SAML SSO with your IdP (Entra, Okta, Ping, Auth0)
  • SCIM 2.0 provisioning and de-provisioning
  • Mirrored RBAC — agents inherit caller's scope
  • Just-in-time elevation with reason capture
  • Session binding to source IP and device posture

Network & perimeter

  • Private link / PrivateLink endpoints supported
  • Outbound allow-listing per agent
  • mTLS to all internal services
  • WAF-protected ingress, DDoS-resilient edge
  • BYO-VPC peering for connector traffic

Data & cryptography

  • Customer-managed keys (KMS / HSM-backed)
  • Per-tenant encryption keys, rotated automatically
  • FIPS 140-2 validated cryptography modules
  • Tokenization & PII redaction at ingress
  • Right-to-be-forgotten flows on every memory store

Model & runtime

  • Prompt-injection defense outside the model
  • Policy-as-code (OPA / Rego) on every tool call
  • Confidence thresholds and approval gates
  • Sandboxed tool execution with timeouts
  • Adversarial red-team suite run on every release
Standards we build on

Open standards everywhere

No proprietary protocols. Everything we ship interoperates with what you already run.

OpenTelemetry

Native traces, metrics and logs — stream to Splunk, Datadog, Grafana, ELK.

OIDC / SAML / SCIM

Identity federation and provisioning from your IdP of choice.

OPA / Rego

Policy-as-code authored, tested and versioned like any other code.

OCI & Kubernetes

Container images and Helm charts for any conformant K8s.

OpenAPI / GraphQL

Every API documented, versioned and code-generated.

CloudEvents

Standard envelope for event-driven integrations.

SPIFFE / SPIRE

Workload identity for service-to-service auth.

SLSA Level 3

Supply-chain attestations for every release artifact.

Scale & performance

Engineered for enterprise throughput

Designed from day one to handle thousands of concurrent agent runs across hundreds of tenants — without sacrificing audit fidelity.

Horizontal scale

Stateless agent runtime pods scale on Kubernetes HPA against queue depth, latency or token spend.

Streaming SLAs

Streaming responses begin within 300ms p95 on managed cloud. Event-driven workflows trigger in <50ms.

Cost optimization

Smart model routing, prompt caching, semantic deduplication and per-tenant token budgets cut LLM spend 40-60%.

High availability

Multi-AZ by default. 99.95% platform availability SLA on dedicated; 99.99% on enterprise plans.

Disaster recovery

Cross-region replication, point-in-time restore, audit-log redundancy. RPO <5 min, RTO <30 min.

Multi-region

Pin tenants to regions for residency. Cross-region failover with policy-bound data movement.

Data & event flow

Three planes of traffic

Configuration flows down; data flows sideways; telemetry flows up. Each has its own latency budget and security model.

Control traffic

Agent definitions, prompts, policies and deployments push from the control plane to data plane regions over signed bundles.

  • Signed, versioned bundles
  • Canary & blue/green rollouts
  • Cryptographic provenance (SLSA)

Data traffic

Agent runs read business data from connected systems and write actions back. Sensitive payloads never leave your VPC.

  • Per-tool egress policy
  • Field-level redaction
  • Idempotent action keys

Telemetry

Traces, metrics, audit events and cost stream upward to observability tools and the immutable audit log.

  • OTel native
  • Append-only audit (WORM)
  • Configurable redaction
Core components

Independent, scalable, replaceable.

A composable architecture so you can adopt incrementally and evolve over time.

Agent runtime

Schedulers, planners, tool routers and memory stores at the heart of execution.

Connector mesh

OOTB and custom connectors to ERP, CRM, ITSM, collaboration and data systems.

Knowledge fabric

Vector + lexical retrieval with document grounding and policy-aware indexing.

Policy engine

RBAC, residency, approval thresholds, redaction and content guardrails.

Telemetry plane

OpenTelemetry-native traces, logs, cost and KPI streams.

Control plane

Tenant, versioning, deployment, secrets and identity federation.

Control vs data plane

A separated control and data plane

xyner separates configuration, identity and deployment (control) from agent execution, knowledge and traffic (data). Customers can host the data plane in their own VPC or on-prem while the control plane remains managed — or run everything on-prem.

  • Single-tenant or dedicated VPC options
  • Customer-managed keys (CMK) with HSM
  • Air-gapped on-prem packaging for sovereign environments
  • OpenTelemetry, OIDC, SAML and SCIM out of the box
CONTROL PLANE Managed by xyner Identity & RBAC Policy & Governance Agent Catalog & Config Observability & Audit DATA PLANE Your VPC / On-Prem Agent Runtime RAG & Vector Store Enterprise Connectors Your Data — stays put mTLS Customer data never leaves the data plane.