Skip to content
Get started

Platform overview

How Alyria's agent-governance platform fits together across Constellation, Beacon, Observatory, Lyra, Umbra, and Spectra, from the endpoint to the cloud.

Alyria is the endpoint agent-governance platform for the AI agents your people run. It governs what every agent may do, detects what it did, and keeps fleet data encrypted by default under an envelope key we delete on account termination or request (a crypto-shred, nothing to configure); enterprises can bring their own KMS key and verify revocation in their own CloudTrail. Six modules cooperate across two pillars: APG (Agent Policy Governance, prevention) and ADR (Agent Detection & Response, detection).

The path of a request

A request from a local agent travels through the platform in order:

  1. Beacon — a signed daemon on every machine. It inventories installed AI tooling and CVEs, then routes the agent's inference and network calls through a local policy service. Enforcement happens at the endpoint, with no cloud hop on the hot path.
  2. Constellation — the mesh. Beacons check in over MCP and share org memory and ingested docs, scoped by division and role resolved from your IdP groups. The same ACL is enforced twice from one source of truth.
  3. Lyra — policy-as-code. One capability-brokered, information-flow-aware policy decides which tools, MCP servers, models, data, and egress each agent may touch. Authored once, enforced at the Beacon.
  4. Umbra — agent secrets. Short-lived credential leases under your keys, with agent-to-agent key exchange (roadmap: keys we never hold, with client-side crypto shipped as open, auditable code). What we store today are static blobs, opaque to us at rest.
  5. Spectra — telemetry. OpenTelemetry from the whole fleet is collected and routed to Alyria Cloud or straight into your own SIEM (Elastic/Kibana).
  6. Observatory — the cloud console. Enterprise SSO, fleet health, CVE posture, policy decisions, and detections in one plane.

Why under your keys

A conventional cloud control plane must decrypt your traffic to inspect it, which makes it the thing worth attacking. Alyria inverts that: enforcement is local and offline, and any fleet data that reaches the cloud is encrypted by default under an envelope key we delete on account termination or request (a crypto-shred, nothing to configure). Enterprises can bring their own KMS key and verify revocation in their own CloudTrail. The roadmap moves further, toward client-held keys we never hold at all, under an externally audited protocol.

Continue to the Quickstart to deploy your first Beacon.

← Back to docs