Skip to main content

Deployment Options

ASCEND offers flexible deployment models to fit your infrastructure requirements. Choose between SDK integration for maximum control or gateway integration for zero-code governance.

Architecture Overview​

Architecture Diagram​

┌─────────────────────────────────────────────────────────────────────────┐
│                         YOUR ENVIRONMENT                                 │
│                                                                          │
│    ┌──────────┐         ┌─────────────┐         ┌─────────────┐        │
│    │ AI Agent │────────▶│  ASCEND SDK │    OR   │ API Gateway │        │
│    └──────────┘         │ (3 lines)   │         │(Kong/Envoy) │        │
│                         └──────┬──────┘         └──────┬──────┘        │
│                                │                       │               │
└────────────────────────────────┼───────────────────────┼───────────────┘
                                 │                       │
                    ═════════════╪═══════════════════════╪═════════════
                                 │  TLS 1.3 / HTTPS      │
                                 │  Action Metadata Only │
                    ═════════════╪═══════════════════════╪═════════════
                                 │                       │
                                 ▼                       ▼
┌─────────────────────────────────────────────────────────────────────────┐
│                          ASCEND CLOUD                                    │
│                                                                          │
│    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌────────┐ │
│    │ Risk Engine │───▶│Policy Engine│───▶│  Workflows  │───▶│ Audit  │ │
│    │ CVSS/NIST   │    │ Smart Rules │    │  Approvals  │    │  Log   │ │
│    └─────────────┘    └─────────────┘    └─────────────┘    └────────┘ │
│                                                                          │
└─────────────────────────────────────────────────────────────────────────┘

    CROSSES BOUNDARY:                    NEVER CROSSES:
    ✓ Action type, Agent ID              ✗ SQL queries, API payloads
    ✓ Timestamp, Risk context            ✗ Credentials, secrets
    ✓ Decision (approve/deny)            ✗ PII/PHI data

Deployment Comparison​

QuestionSaaS + SDKSaaS + Gateway
Where does ASCEND run?ASCEND CloudASCEND Cloud
Agent code changes?Yes (3 lines)No
Time to first value5 minutes1 hour
Latency added~15-50ms p50-p99~20-60ms p50-p99
Best forNew agents, full controlExisting APIs, zero-code
MCP supportNativeVia gateway
Approval workflowSDK handles pollingWebhook callbacks

Option 1: SaaS + SDK (Recommended)​

Best for: New AI agents or agents you can modify.

Integration Code:

from ascend import AscendClient

# Initialize once
client = AscendClient(api_key=os.getenv("ASCEND_API_KEY"))

# Add to each action (3 lines)
decision = client.evaluate_action(
    action_type="database.query",
    resource="customer_db"
)
if decision.denied:
    return {"error": decision.reason}

# Your existing code continues unchanged
result = database.execute(query)

Option 2: SaaS + Gateway​

Best for: Existing APIs you cannot modify.

Supported Gateways:

GatewayIntegrationDocumentation
AWS API GatewayLambda AuthorizerSetup Guide
KongCustom PluginKong Plugin
Envoy/Istioext_authzEnvoy Integration
NGINXAuth subrequestContact support

What Crosses the Network Boundary?​

Understanding data flow is critical for security reviews.

Example Request​

What ASCEND receives:

{
  "agent_id": "financial-advisor-001",
  "action_type": "database.query",
  "resource": "customer_accounts",
  "environment": "production",
  "timestamp": "2026-01-21T10:30:00Z",
  "context": {
    "contains_pii": true,
    "data_classification": "confidential"
  }
}

What ASCEND NEVER receives:

{
  "sql_query": "SELECT * FROM accounts WHERE id = 12345",
  "customer_name": "John Smith",
  "account_balance": 50000.00,
  "ssn": "123-45-6789",
  "api_key": "sk-xxxx",
  "database_password": "..."
}

Data Boundary Summary​

Data TypeCrosses Boundary?EncryptionStorage
Action typeYesTLS 1.3 in transitLogged
Agent IDYesTLS 1.3 in transitLogged
TimestampYesTLS 1.3 in transitLogged
Risk scoreYes (returned)TLS 1.3 in transitLogged
DecisionYes (returned)TLS 1.3 in transitLogged
Request payloadNON/ANever stored
Response dataNON/ANever stored
CredentialsNON/ANever stored
PII/PHINON/ANever stored

Network Requirements​

Outbound Connectivity​

Your environment needs outbound HTTPS access to ASCEND:

DestinationPortProtocolPurpose
api.ascendowkai.com443HTTPS (TLS 1.3)API requests
pilot.owkai.app443HTTPS (TLS 1.3)Pilot environment

Firewall Rules​

# Allow outbound HTTPS to ASCEND
iptables -A OUTPUT -p tcp --dport 443 -d api.ascendowkai.com -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -d pilot.owkai.app -j ACCEPT

IP Allowlist​

For IP-based firewall rules, contact support for current IP ranges.

High Availability​

ASCEND Cloud SLA​

MetricTargetMeasurement
Uptime99.9%Monthly
API Latency (p50)< 50msPer request
API Latency (p99)< 150msPer request
RTO4 hoursDisaster recovery
RPO1 hourData recovery

Failover Behavior​

Configure SDK fail mode for your availability requirements:

from ascend import AscendClient, FailMode

# Security-first (recommended for production)
client = AscendClient(
    api_key="...",
    fail_mode=FailMode.CLOSED  # Block if ASCEND unavailable
)

# Availability-first (for development/testing)
client = AscendClient(
    api_key="...",
    fail_mode=FailMode.OPEN  # Allow if ASCEND unavailable
)

Multi-Region Deployment​

Current Availability​

RegionStatusEndpoint
US East (N. Virginia)Productionapi.ascendowkai.com
EU (Frankfurt)Coming Q2 2026eu.api.ascendowkai.com
APAC (Singapore)Coming Q3 2026ap.api.ascendowkai.com

Data Residency​

For EU data residency requirements, contact sales@ascendowkai.com.

Security Architecture​

Security Controls by Layer​

LayerControlsImplementation
NetworkWAF, DDoS protection, VPC isolationAWS Shield, WAF rules
TransportTLS 1.3, HSTS, certificate pinningALB, SDK
AuthenticationAPI key (SHA-256), JWT (RS256), MFACognito, custom auth
AuthorizationRBAC (6 levels), RLSPostgreSQL RLS, middleware
DataAES-256 encryption, BYOKAWS KMS, customer keys
AuditImmutable logs, hash-chainWORM S3, PostgreSQL

Integration Decision Matrix​

Use this matrix to choose your integration approach:

ScenarioRecommendedReason
Building new AI agentSDKFull control, native integration
Existing API endpointsGatewayZero code changes
MCP serverSDKNative MCP support
LangChain agentSDKLangChain callback support
High-volume (>1000 rps)GatewayLower latency, connection pooling
Strict latency (<10ms)GatewayAsync evaluation
Multi-language agentsGatewayLanguage-agnostic
Need approval workflowsSDKBuilt-in polling/webhooks

Next Steps​

  1. Adoption Path — Day-1 to Day-30 implementation guide
  2. Quick Start — Get your first agent governed in 5 minutes
  3. SDK Installation — Full SDK setup guide
  4. Gateway Integration — Zero-code options

Last Updated: 2026-01-21