01Environments
deployment guidance · recommended
- Dev, test and prod as fully separate deployments: their own data volumes, model-gateway credentials and spend limits, IdP clients, vault paths and integration credentials. Test points at non-production systems and a twin of them.
- A non-production mode that can never act like production: no push notifications, no schedules or triggers, a visible badge.
- Rehearsal labs (emulation) are their own environment with their own vault paths, built from the source of truth by the pipeline.
02Delivery
deployment guidance · recommended
- Build the orchestrator image (with its tool servers) and the client once per commit; scan and sign them.
- Test on every change: type checks, a safety suite that drives the permission layer directly with no model and no network (refusals, cards, digests, budgets, redaction, the audit chain), and a contract check against the infrastructure repository's rules.
- Evaluate in test with the model in the loop: a smoke test (a read runs, a write is denied) and behaviour cases with approvals auto-denied. Re-run them whenever the model mapping changes.
- Promote the same image digest through dev, test and prod; never rebuild per environment.
- Deploy with a health check and an automatic rollback to the previous digest if it fails.
- Re-admit changed tool servers in each environment after reviewing their source diff; until then the orchestrator refuses to start them.
03Observability and SLOs
deployment guidance · recommended
- Availability: the health endpoint probed from inside your network; page on sustained failure.
- Turn success: the error share of finished turns; a rise usually means the model gateway or an integration is failing.
- Approval latency: time from a card being raised to its decision, from the audit log; a target per change type.
- Spend: daily cost against a budget, and budget stops as an early warning.
- Integrity: a scheduled audit-chain verification that must pass; the twin's golden flows passing after every change.
- Ship the audit log to the SIEM continuously and keep it for your audit retention period; ship container logs next to it.
04Configuration and secrets
Configuration
- Site configuration is mounted at deploy time and replaces the defaults of the same name: the prompt layers (identity, operator policy), specialist definitions, roles, research domains, protected targets, tool-server definitions.
- Files ODIN writes itself through the admin console (admission, policy, budgets, access profiles, automations) are written atomically and re-read on change, without a restart.
- Unreadable files fail closed: admission admits nothing, policy denies everything, budgets fall back to defaults, automations run none.
- Keep the rest of the configuration in a repository, reviewed like code, applied per environment.
Secrets
- Everything secret in the vault: the gateway credential, tool-server read tokens, the OIDC client secret, trigger and webhook secrets, the metrics token.
- Rendered at deploy time into the orchestrator's environment and the tool servers' own configuration, never into an image, a repository or a prompt.
- Pipelines fetch their own short-lived credentials at run time; ODIN never brokers them (Guardrails).
- Rotate in the vault and restart; tool servers pick up new tokens for agents started after the change.
05Mapping onto a platform
deployment guidance · recommended
| Piece | Kubernetes / OpenShift | Virtual machines (vSphere, Proxmox VE, Nutanix, Azure, AWS) |
|---|---|---|
| Orchestrator + tool servers | A Deployment with one replica, the Recreate strategy, liveness and readiness on the health endpoint | One VM running the container, restarted on failure by your service manager |
| Client | A stateless Deployment | The same VM or a separate one |
| State | A ReadWriteOnce persistent volume with snapshots | A dedicated or replicated volume with snapshots |
| Configuration | ConfigMaps, and Secrets rendered from the vault | Rendered by configuration management at deploy time |
| Edge | Ingress behind the zero-trust proxy; client paths only | An internal reverse proxy behind the zero-trust proxy |
| Triggers | A cluster-internal Service | A firewall rule from the monitoring network only |