Enterprise Features¶

SafeAI provides enterprise-grade security, observability, and governance primitives for production AI deployments — multi-tenant isolation, audit retention, secret backends, real-time streaming, and cost controls out of the box.

python -m safeai.cli.main setup langchain   # scaffold a project
python -m safeai.cli.main serve              # start the gateway

Multi-Tenant Isolation¶

Tenant-scoped policies let you define per-organisation rules that override global defaults. When tenant_id matches a rule, that rule takes priority; otherwise the engine falls back to the global policy set.

from safeai.core.policy import PolicyEngine, PolicyContext, PolicyRule

rules = [
    PolicyRule(
        name="global-block-secrets",
        boundary="input",
        data_tags=["secret.credential"],
        action="block",
    ),
    PolicyRule(
        name="acme-allow-pii",
        boundary="input",
        data_tags=["personal.pii"],
        action="allow",
        tenant_id="acme",
    ),
    PolicyRule(
        name="default-redact-pii",
        boundary="input",
        data_tags=["personal.pii"],
        action="redact",
    ),
]

engine = PolicyEngine(rules=rules)

# Acme tenant — tenant-specific rule wins
ctx = PolicyContext(boundary="input", data_tags=["personal.pii"], tenant_id="acme")
decision = engine.evaluate(ctx)   # → "allow"

# Default tenant — global redact rule applies
ctx = PolicyContext(boundary="input", data_tags=["personal.pii"], tenant_id="default")
decision = engine.evaluate(ctx)   # → "redact"

Tenant Configuration¶

tenants:
  acme:
    policies:
      - name: acme-allow-pii
        boundary: input
        data_tags: ["personal.pii"]
        action: allow
  default:
    policies:
      - name: default-redact-pii
        boundary: input
        data_tags: ["personal.pii"]
        action: redact

Audit Retention¶

SafeAI rotates and compresses audit logs automatically. Configure size limits, age thresholds, and compression in safeai.yaml.

audit:
  max_size_mb: 100
  max_age_days: 90
  compress_rotated: true

from safeai.config.models import SafeAIConfig

cfg = SafeAIConfig()
print(f"max_size={cfg.audit.max_size_mb}MB, max_age={cfg.audit.max_age_days}d")

Secret Backends¶

SafeAI supports pluggable secret backends so credentials never live in plain-text config files. Choose from environment variables, HashiCorp Vault, or AWS Secrets Manager.

secrets:
  backend: vault          # env | vault | aws
  vault:
    address: https://vault.internal:8200
    token_env: VAULT_TOKEN
    path: secret/data/safeai
  aws:
    region: us-east-1
    secret_name: safeai/prod

Backend Reference¶

Alert Channels¶

Route policy violations, budget overruns, and system events to your incident management stack.

alerts:
  channels:
    - type: email
      to: ["security-team@example.com"]
      smtp_host: smtp.example.com
      smtp_port: 587
    - type: pagerduty
      routing_key: ${PAGERDUTY_KEY}
    - type: opsgenie
      api_key: ${OPSGENIE_KEY}
      region: us

from safeai.alerting.email import EmailAlertChannel
from safeai.alerting.pagerduty import PagerDutyAlertChannel
from safeai.alerting.opsgenie import OpsgenieAlertChannel

WebSocket Streaming¶

Subscribe to real-time policy events over a persistent WebSocket connection. The /v1/ws/events endpoint streams decisions as they happen.

import asyncio
import json
import websockets

async def stream_events():
    uri = "ws://127.0.0.1:8910/v1/ws/events"
    async with websockets.connect(uri) as ws:
        # Subscribe to input-boundary events
        await ws.send(json.dumps({"boundary": "input"}))
        async for message in ws:
            event = json.loads(message)
            print(f"[{event['timestamp']}] {event['action']} — {event['rule']}")

asyncio.run(stream_events())

MCP Write Operations¶

The Model Context Protocol (MCP) server exposes the following write-capable tools for programmatic governance:

OpenAPI Documentation¶

The SafeAI gateway auto-generates interactive API docs from its route definitions.

# Verify docs are live
curl -s http://127.0.0.1:8910/docs | head -5

# Fetch raw spec
curl -s http://127.0.0.1:8910/openapi.json | python -m json.tool | head -20

Framework Setup¶

Scaffold SafeAI integration boilerplate for popular agent frameworks with a single command.

python -m safeai.cli.main setup langchain
python -m safeai.cli.main setup crewai
python -m safeai.cli.main setup autogen

Cost Dashboard¶

Monitor AI spend per user, tenant, or model via the built-in cost dashboard endpoint.

curl -s http://127.0.0.1:8910/v1/dashboard/cost/summary \
  -H "x-safeai-user: admin" | python -m json.tool

The response includes:

Routing Proxy¶

The gateway can also proxy requests to downstream LLM providers while enforcing policies, budgets, and audit logging transparently. Configure the proxy target in safeai.yaml:

proxy:
  target: https://api.openai.com/v1
  timeout_seconds: 30
  retry:
    max_attempts: 3
    backoff_factor: 0.5

See Also¶

• Policy Engine
• Audit Logging
• Approval Workflows
• Creating Plugins
• Troubleshooting