User guide¶
The operator's manual: what every screen does, where to find it, and how the moving parts actually work.
Agent Access Manager is a security-and-governance layer in front of your LLM providers. You give it the master keys for your vendors (OpenAI, Anthropic, Gemini, a local Ollama, any OpenAI-compatible server). It hands your applications one OpenAI-compatible endpoint plus its own virtual keys, then routes and load-balances across vendors with fallback, meters token and cost budgets, screens content with guardrails, and writes a durable audit trail you can search, alert on, and report from.
Applies to
This guide tracks the current release (dashboard v0.1.0). The guide is bundled with the product, so it always matches what you are running, online or air-gapped.
How to read this guide¶
The guide is organised exactly like the dashboard's left nav, so when you are on a screen you can find its section here by the same name. Every feature opens with a one-line "chip" that tells you the three things you usually want first:
Where: Operate ▸ Catalog · Who: operator and up (
MANAGE_DEPLOYMENTS) · Editions: all
- Where is the nav path (group ▸ page, plus the tab if the page has tabs).
- Who is the minimum role and the backing capability (see Roles and capabilities). The dashboard hides or disables what your role cannot use; the backend is the real gate.
- Editions is which deployment tier the feature needs (see Editions). Most features are in all editions; the security-operations and AI-classifier pieces need Pro / Pro AI.
Two ways to drive everything
Every screen is a thin face over a REST API under /admin/**. Anything you can click you can also script with curl or the SDK using the same endpoints (named in each section). The data plane your applications call is the separate, OpenAI-compatible /v1/** surface.
The dashboard at a glance¶
The console has a fixed left rail grouped into Overview, Operate, Govern, Investigate, and your Account (Settings, Profile) at the bottom. A top bar carries the command palette (Ctrl+K / Cmd+K), the notifications bell, the theme toggle, and your avatar.
I want to… (where to go)¶
| I want to… | Go to | Section |
|---|---|---|
| Give an application access to models | Operate ▸ Virtual keys | Virtual keys |
| Connect OpenAI / Anthropic / Gemini / a local Ollama | Operate ▸ Catalog | Catalog |
| Understand how a request picks a vendor | Operate ▸ Catalog | How routing works |
| Cap spend in dollars or tokens | Operate ▸ Budgets | Budgets |
| Throttle requests per minute (RPM/TPM) | Operate ▸ Rate limits | Rate limits |
| Try a model in a chat window | Operate ▸ Playground | Playground |
| Add a teammate, make a team, send an invite | Operate ▸ Organizations | Organizations |
| Stop PII or secrets leaking in prompts/replies | Govern ▸ Guardrails | Guardrails |
| Get emailed / paged when something fires | Govern ▸ Notifications | Notifications |
| See every call and who spent what | Govern ▸ Audit & usage | Audit & usage |
| Schedule a branded PDF / CSV cost report | Govern ▸ Reports | Reports |
| Check for failed or suspicious admin logins | Govern ▸ Sign-in activity | Sign-in activity |
| Search and chart the security event stream | Investigate ▸ SIEM | SIEM |
| Spot a key or IP behaving abnormally | Investigate ▸ UEBA | UEBA |
| Auto-contain abuse (quarantine / throttle) | Investigate ▸ SOAR | SOAR |
| Configure the mail (SMTP) server | Settings | Settings |
| Change theme, timezone, or sign out | Profile | Profile |
The shape of the product¶
Everything below rests on four ideas. They are explained in full in Core concepts; the one-liners:
- One endpoint, many vendors. Applications always speak the OpenAI chat shape to
/v1/**. Agent Access Manager translates outbound to whatever the chosen vendor speaks. Adding a vendor never changes your application. - Everything is scoped. Keys, budgets, rate limits, and guardrail policies attach to a scope: an organization, a team, a project, or a single key. Limits are enforced at every level in the chain at once. See Scopes.
- Roles decide who can do what. A small capability model (owner ▸ admin ▸ operator ▸ user ▸ guest) gates the screens. Money is its own capability. See Roles and capabilities.
- Governance is event-driven. Every call publishes a durable event. That one stream feeds the audit trail, spend metering, alerts, reports, and the SOAR engine, plus (on Pro) the SIEM projection. Nothing you proxy waits on any of it.
Editions: one product, tiered¶
There is one binary and one dashboard. An "edition" is just which optional infrastructure you switch on, layered as compose overlays (or Helm values) on the base stack. Nothing is a different build, so you can grow from a single box to a cluster without re-installing or relearning the UI.
| Core (standalone) | Pro (+ OpenSearch) | Pro AI (+ AI sidecars) | Distributed (scale-out) | |
|---|---|---|---|---|
| Runs on | one box: app + Postgres | + OpenSearch | + Presidio / Llama Guard | N app replicas + LB |
| Gateway, keys, catalog, routing | ✅ | ✅ | ✅ | ✅ |
| Guardrails (regex / pattern) | ✅ | ✅ | ✅ | ✅ |
| Budgets, rate limits, notifications, reports | ✅ | ✅ | ✅ | ✅ |
| Audit trail system of record | Postgres | OpenSearch | OpenSearch | OpenSearch |
| SOAR auto-containment (quarantine / throttle) | ✅ | ✅ | ✅ | ✅ |
| SIEM search, UEBA, detections, Sigma | - | ✅ | ✅ | ✅ |
| Remote AI-classifier guardrails (PII spans, content safety) | - | - | ✅ | ✅ |
| Rate-limit counters across instances | in-JVM | in-JVM | in-JVM | Valkey |
| Bundled SSO (Keycloak) | optional overlay | optional overlay | optional overlay | optional overlay |
The default and the lightest. The app plus a Postgres database, optionally with bundled Keycloak for SSO. Rate-limit counters live in the JVM, the audit trail is Postgres, and the SIEM and UEBA pages are dormant (SOAR still runs - it needs no OpenSearch). This is the right starting point for most on-prem installs and covers the entire data plane plus governance.
Compose: deploy/compose/standalone.yml.
Adds an OpenSearch cluster. This turns on the rest of the Investigate group (SIEM event search, UEBA anomaly detection, detection + Sigma rules - SOAR already ran without it) and promotes OpenSearch to the audit system of record, so the audit trail is searchable, retained longer, and snapshot-archivable. The dashboard is identical; the Investigate pages light up.
Compose: standalone.yml + standalone.pro.yml.
Adds local AI sidecars for guardrails: Presidio (PII entity spans, redactable) and a Llama Guard-class content-safety classifier. These back the remote detector kinds, so guardrails can do semantic PII detection and content-safety verdicts rather than only regex. No data leaves the box.
Compose: + standalone.ai.yml.
The gateway data plane is stateless, so it scales horizontally behind a load balancer. Shared state moves to Valkey (the hot rate-limit counters and config-change broadcasts) and OpenSearch (the SIEM projection). A single instance owns the scheduled maintenance via a cluster lock. Single-host multi-replica uses deploy/compose/distributed.yml; multi-machine uses the Helm chart.
See How Agent Access Manager is deployed for the full infrastructure picture (Postgres, Valkey, OpenSearch, object storage, SMTP, AI servers).
Where to start¶
Scopes and the scope chain, roles and capabilities, virtual keys vs the admin plane, and the event/audit model. Read this once; everything else assumes it.
Organizations, virtual keys, the catalog and how routing really works, the playground, budgets, and rate limits.
Guardrails, notifications, audit and usage, reports (with a worked example), and sign-in activity.
SIEM search and querying and UEBA anomaly detection (Pro), plus SOAR auto-containment on every tier.
Standalone vs distributed, and what each external piece does: AI servers, Postgres, Valkey, OpenSearch, object storage, and SMTP.
The mail server, the authentication posture, and your personal preferences.
End-to-end tasks start to finish: onboard a tenant, set up cost-aware failover, lock down PII, ship a report, auto-contain abuse.