DOCUMENTATION

Architecture & Pilot Access

3 Docker services. 23 REST endpoints. On-premises.
Your AI keys. Your data never leaves.

Explore the architecture below. When you're ready, apply for pilot access.

Currently onboarding select organizations in finance, healthcare, and legal.

Prerequisites

Docker 24+

Docker Engine with Compose v2. Any OS.

curl / httpie

Any HTTP client to hit the REST API.

opt
API Key

Only needed for production. Dev mode runs keyless.

version-check
$ docker --version
Docker version 24.0.7, build afdd53b
$ docker compose version
Docker Compose version v2.24.5

Quickstart: 3 Steps

From zero to settled in under 60 seconds.

1

Start the Stack

terminal
# Start the settlement layer
$ docker compose up -d
# Response:
3 services started
Gateway ready on localhost
2

Create a Settlement Session

terminal
# Create a new settlement session
$ curl -X POST $GATEWAY/v1/session -d '{"agent": "my-agent"}'
# Response:
{ "session_id": "sess_...", "status": "OPEN" }
3

Get the Settlement Receipt

terminal
# Retrieve the settlement receipt
$ curl $GATEWAY/v1/evidence/$SESSION_ID/settlement
# Response:
{
"status": "SETTLED",
"delta1": true,
"evidence_hash": "sha256:9f86d0..."
}

That's it. Every AI decision now produces a cryptographic settlement receipt.

Architecture: 6-Layer Control Stack

Each layer addresses a distinct attack surface. 12 patents pending, 354+ claims.

L0 Settlement Validation Layer

Per-decision Δ1 validation. Binary closure: all conditions met, or session stays open.

L1 Agent Authorization Layer

Per-agent scopes and policy enforcement. Authorization required before any consequential action.

L2 Governance Layer (Cognitive)

Addresses cognitive leakage. Mechanism proprietary.

L3 Governance Layer (Model Integrity)

Addresses conjunctive leakage. Mechanism proprietary.

L4 Evidence Sealing Layer

Hash-chained evidence packs. TSA timestamping. Tamper-evident audit trail.

L5 Long-Horizon Anomaly Layer

Detects multi-session anomaly patterns. Detection heuristics proprietary.

Layer-level mechanisms, internal protocols, and detection heuristics are proprietary. Full architecture walkthrough available under NDA during pilot onboarding. Request walkthrough →

API Overview

One unified Gateway. REST in, JSON out. All on-premises.

23
REST endpoints
3
Docker services
1,052
automated tests
0
external dependencies

Gateway — Primary Interface

All interactions go through a single Gateway service. You create sessions, record evidence, and retrieve settlement receipts through standard REST calls. Internal service coordination is handled automatically.

POST Create settlement session
POST Record evidence packet
GET  Get settlement receipt
POST Verify Δ1 conditions
GET  Export audit-ready pack
GET  Health & metrics

Full OpenAPI spec and endpoint documentation available during pilot onboarding.

Integration

Your AI logic stays untouched. AAL wraps the decision boundary.

Step 1

Open Session

One REST call creates a settlement session for your agent.

Step 2

Record Decisions

Each decision your AI makes is recorded and hash-chained automatically.

Step 3

Get Receipt

Δ1 validates automatically. You get a cryptographic settlement receipt.

Python SDK and full integration guide provided during pilot onboarding.
Works with any language, any framework. REST in, JSON out.

Deployment Models

Choose what fits your environment. All deploy on-premises.

Docker Compose

Development & pilot deployments.

$ docker compose up
3 services, single machine
Zero configuration

Kubernetes

Production at scale.

Helm chart provided
Horizontal pod autoscaling
Multi-region support

Air-Gapped

Regulated environments.

No external dependencies
Offline TSA fallback
On-premises only

Questions? Let's talk.

Architecture walkthrough, pilot setup, or compliance mapping — we cover it all in 15 minutes.

yc@oia-lab.com

On-premises deployment. Your AI keys. Your data never leaves. Currently onboarding select organizations in finance, healthcare, and legal.

AAL provides evidence infrastructure aligned with regulatory requirements including the EU AI Act and Colorado SB 24-205. It does not constitute legal advice, compliance certification, or audit attestation. Compliance depends on your organizational controls and deployment configuration. 12 patents pending (354+ claims). 9 published papers with DOI.