Architecture & Integration

Self-hosted Rust appliance. Deploys in your VPC, bare-metal server, or air-gapped OT network. Plugs beneath whatever agent framework or service mesh you already run.

How Daylite deploys

Control plane + data plane

Daylite runs as a central control plane (1-3 HA instances). Agents emit audit events via SDK, proxy mode, or WASM filter. The control plane appends to a SHA-256 hash-chain with HMAC-SHA-256 signatures and generates regulator-admissible evidence packs on demand.

docker — fastest path
docker run -p 8080:8080 \
  -e DAYLITE_PROFILE=nerc-cip-015-1 \
  -e DATABASE_URL=postgres://daylite:secret@db/daylite \
  ghcr.io/daylite-ai/daylite:latest

# Daylite control plane is running on port 8080.
# Hash-chain audit is active. Profile loaded.
# Next step: integrate your agent framework via SDK or WASM filter.
verify the hash-chain
curl http://localhost:8080/v1/audit/verify

# Returns chain integrity status:
# {
#   "chain_length": 0,
#   "verified": true,
#   "last_hash": "genesis",
#   "profile": "nerc-cip-015-1"
# }

Integration Patterns

Three ways to feed agent actions into Daylite. Choose based on your existing stack.

Pattern A: SDK Integration (most common)

Embed the Daylite SDK in your agent framework — LangGraph, AutoGen, kagent, Dapr, or custom. Every tool call, state change, and decision emits an event to the control plane asynchronously.

python — LangGraph integration
from daylite import DayliteClient

client = DayliteClient(
    control_plane_url="http://daylite.internal:8080",
    api_key="dyl_...",
    agent_id="kyc-automation-v2",
)

# In your LangGraph node
def execute_tool(state):
    with client.audit_step(
        tool_name="salesforce.query",
        classification="CONFIDENTIAL",
    ) as step:
        result = salesforce_api.query(state["account_id"])
        step.record_output_hash(result)
        return result

# Every call produces:
# - SHA-256 hash-chain entry
# - HMAC-signed audit record
# - UUIDv7 step identity
# - Merkle tree aggregation

Pattern B: Proxy Mode (no SDK changes)

Route MCP tool calls through Daylite proxy. Five-step policy enforcement on every call: secret scan, PII scan, classification ceiling, tool policy, cryptographic sign.

MCP proxy JSON-RPC 2.0
POST /v1/mcp/proxy
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "name": "github.create_issue",
    "arguments": {...}
  },
  "id": 1
}

# Response headers:
# X-Daylite-Agent: 018f3c4a-... (UUIDv7)
# X-Daylite-Audit: chained (SHA-256 hash-chain recorded)
# X-Daylite-Verdict: allow (policy check passed)

Pattern C: WASM Filter (for existing Envoy mesh)

Compile Daylite as a proxy-wasm filter for Envoy. Plugs into Solo.io agentgateway, Tetrate Agent Router, or any Istio deployment. Adds cryptographic audit without replacing the mesh.

envoy filter config
http_filters:
  - name: daylite-wasm
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
      config:
        name: "daylite-audit-filter"
        root_id: "daylite-audit"
        vm_config:
          runtime: "envoy.wasm.runtime.v8"
          code:
            local: { filename: "/etc/envoy/daylite-filter.wasm" }
        configuration:
          "@type": type.googleapis.com/google.protobuf.StringValue
          value: |
            {
              "control_plane_url": "http://daylite.internal:8080",
              "profile": "dora-art12",
              "sample_rate": 1.0
            }

Regulatory Profiles

Profiles are YAML bundles that map regulatory requirements to enforceable policies and evidence formats. Ship as part of the binary.

nerc-cip-015-1.yaml
FERC Order 907 internal network security monitoring. Output format aligned with NERC RSAW expectations. Retention 6+ years. Forwards violations via syslog to Dragos, Nozomi, Splunk OT.
dora-art12.yaml
DORA Article 12 tamper-evident logging for EU financial entities. Register of Information format support. ICT risk event taxonomy. Critical Third-Party Provider (CTPP) exit-strategy metadata.
finma-08-2024.yaml
FINMA Guidance 08/2024 AI governance. Explainability metadata, traceability chain, Swiss Banking Act Article 47 client-data localization guards. German-language auditor report template.
eu-ai-act-annex-viii.yaml
EU AI Act Article 12 automatic logging, Annex VIII registration export, Article 14 human oversight metadata. High-risk AI categorization via Annex III profile.

Deployment Options

docker-compose — HA control plane with PostgreSQL
services:
  daylite:
    image: ghcr.io/daylite-ai/daylite:latest
    ports: ["8080:8080"]
    environment:
      DATABASE_URL: postgres://daylite:secret@db:5432/daylite
      DAYLITE_PROFILE: nerc-cip-015-1
      DAYLITE_HMAC_KEY_FILE: /run/secrets/hmac_key
    depends_on: [db]
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: daylite
      POSTGRES_USER: daylite
      POSTGRES_PASSWORD: secret
helm — kubernetes
helm install daylite oci://ghcr.io/daylite-ai/charts/daylite \
  --set profile=dora-art12 \
  --set replicaCount=3 \
  --set persistence.enabled=true
zarf — air-gapped OT network
zarf package create .  # bundles binary + HMAC keys + config
# Transfer via approved media
zarf package deploy daylite-package.tar.zst

# No internet, no DNS, no external dependencies.
# Deploys inside SCIFs, NERC CIP Electronic Security Perimeters,
# validated pharma environments.

API Endpoints

MethodEndpointDescription
POST/v1/audit/eventsEmit audit event (SDK endpoint)
GET/v1/audit/verifyVerify hash-chain integrity (offline-capable)
POST/v1/audit/export/annex-viiiExport EU AI Act Annex VIII registration JSON
POST/v1/audit/export/regulatoryExport regulator-ready evidence pack (ZIP)
POST/v1/mcp/proxyMCP JSON-RPC proxy with 5-step policy enforcement
GET/v1/compliance/nist-800-53NIST 800-53 Rev 5 control mapping
GET/v1/compliance/eu-ai-actEU AI Act ↔ NIST 800-53 unified mapping
POST/v1/api-keysCreate tenant API key (dyl_ prefix, SHA-256 stored)
GET/POST/scim/v2/UsersSCIM 2.0 user provisioning (RFC 7644)

Authentication

API key
Authorization: Bearer dyl_your-api-key

Keys provisioned via API, SCIM 2.0, or OIDC SSO (Okta, Microsoft Entra ID, any OpenID Connect provider). Stored as SHA-256 hashes. mTLS with your internal CA supported for zero-trust environments.

Response Headers

HeaderDescription
X-Daylite-AgentUUIDv7 per-step agent identity
X-Daylite-AuditHash-chain status (chained / signed / verified)
X-Daylite-VerdictPolicy engine decision (allow / deny / audit-only)
X-Daylite-ClassificationData classification tier applied
X-Daylite-ProfileRegulatory profile active for this tenant
Request architecture review