Skip to main content

Platform Capabilities

AxonFlow is an AI control plane that sits between your applications and LLM infrastructure. It enforces governance policies on every request, routes queries to the right LLM provider, coordinates multi-agent workflows, and records immutable audit trails -- all with sub-10ms overhead at the policy layer.

The Problem​

Organizations deploying AI agents face several challenges:

  • Governance Gap: AI agents make decisions in milliseconds, but governance reviews take days
  • Data Access Control: Agents need data from multiple sources, each with different permission models
  • Compliance Requirements: Regulated industries (healthcare, finance) require audit trails and access controls
  • Multi-Agent Complexity: Coordinating multiple AI agents working together is error-prone
  • LLM Provider Lock-in: Switching providers or adding redundancy requires significant engineering

AxonFlow addresses these challenges with a unified control plane that sits between your applications and AI infrastructure.

Sub-10ms Policy Enforcement​

Every AI agent request passes through AxonFlow's policy engine, which evaluates governance rules and makes allow/deny decisions in under 10 milliseconds (P95).

How it works:

  • In-Memory Evaluation: Policies are compiled to an in-memory representation and cached. Evaluation itself runs in sub-millisecond time.
  • Async Audit Writes: Audit log writes happen asynchronously after the response is returned, keeping them off the critical path.
  • Horizontal Scaling: The agent is stateless. Add more instances behind a load balancer to handle higher throughput.

Example: A healthcare AI assistant processing 10,000 patient queries per hour. Each query is checked against HIPAA policies (patient assignment, minimum necessary rule, PII detection) in under 10ms before the response is returned.

Policy-as-Code​

Governance policies are defined as code using Rego (Open Policy Agent), stored in version control, and deployed through your existing CI/CD pipeline. Policies can be updated in real-time without redeploying your applications.

Key properties:

  • Auditability: Every policy change is tracked in git with full history
  • Consistency: Same policies apply across development, staging, and production
  • Agility: Update policies instantly when regulations change
package axonflow.policy

# Only doctors can access patient records
allow {
    input.context.user_role == "doctor"
    input.context.patient_assigned == true
}

# Automatically redact PII from responses
redact_pii {
    contains(input.response, "SSN")
}

Policies are written in Rego, a declarative language designed for policy decisions. AxonFlow evaluates these policies on every request and response.

Multi-Agent Planning (MAP)​

MAP enables complex AI workflows by decomposing tasks and coordinating multiple specialized agents in parallel.

Real-world AI applications often require multiple steps: search data, analyze results, generate recommendations, validate output. Running these sequentially is slow. MAP identifies which tasks can run in parallel and orchestrates execution automatically.

User Query: "Plan a 5-day trip to Tokyo"

MAP Decomposition:
├── Flight Search (Amadeus)     ─┐
├── Hotel Search (Amadeus)      ─┼─→ Combine → Generate Itinerary
├── Activity Suggestions (LLM)  ─┘
└── Weather Forecast (API)      ─┘

Sequential: ~25 seconds
Parallel (MAP): ~8 seconds

The planning engine analyzes the query, identifies independent tasks, executes them in parallel, and combines results -- all while enforcing policies on each step.

MCP Connectors​

Model Context Protocol (MCP) provides standardized, permission-aware access to external data sources. Instead of building custom integrations for each data source, you configure connectors that handle authentication, rate limiting, and access control.

Available Connectors:

  • Databases: PostgreSQL, Redis, Cassandra
  • Cloud Storage: S3, GCS, Azure Blob
  • APIs: HTTP/REST, Amadeus GDS, Salesforce, Slack
  • Data Warehouses: Snowflake

Permission-Aware Access:

permissions:
  - "flights:search:*"      # Can search any flight
  - "hotels:book:domestic"  # Can book domestic hotels only
  - "crm:read:own_accounts" # Can read own customer accounts

Every data request validates permissions before execution. Unauthorized access is blocked and logged.

Service Identity​

Service Identity provides machine-to-machine authentication for AI agents. Each agent or service has a unique identity with specific permissions, separate from user authentication.

When an AI agent accesses data on behalf of a user, Service Identity tracks which service made the request, what permissions that service has, and whether it is acting on behalf of an authorized user -- using cryptographically verifiable credentials.

const client = new AxonFlow({
  serviceIdentity: {
    name: 'trip-planner',
    type: 'backend-service',
    permissions: [
      'mcp:amadeus:search_flights',
      'mcp:amadeus:search_hotels'
    ]
  }
});

Immutable Audit Trails​

Every AI agent action is recorded in append-only audit logs that capture the full request lifecycle: who made the request, what data was accessed, which policies were evaluated, and what response was returned.

Captured per request:

  • Request timestamp and unique ID
  • User identity and service identity
  • Query content (with PII redacted)
  • Policy evaluation results and latency
  • Data sources accessed via MCP
  • Response summary

Durability: Synchronous writes to PostgreSQL with multi-AZ replication. Automatic retry on transient failures.

Multi-Model LLM Support​

AxonFlow routes LLM requests to the optimal provider based on compliance requirements, cost constraints, latency targets, or availability.

Supported Providers:

  • OpenAI (GPT-4o, GPT-4, GPT-3.5)
  • Anthropic (Claude 4.x, Claude 3.5)
  • Azure OpenAI (GPT-4o, GPT-4 via Azure endpoints)
  • Google Gemini (Gemini 2.0, Gemini 1.5)
  • AWS Bedrock (Claude, Titan, Llama via your AWS account)
  • Ollama (self-hosted models for air-gapped environments)

Routing capabilities:

  • Compliance routing: HIPAA-regulated data goes to Bedrock (stays in your AWS account), not external APIs
  • Air-gapped routing: Government/defense systems use Ollama with no external API calls
  • Cost routing: Simple queries go to cheaper models, complex queries to premium
  • Failover: Automatic fallback when a provider is unavailable

In-VPC Deployment​

AxonFlow deploys entirely within your AWS VPC. Your data never leaves your infrastructure -- not even for policy evaluation or LLM routing.

  • ECS Fargate: Serverless containers in your VPC
  • RDS Multi-AZ: Database in private subnets with no public access
  • VPC Endpoints: AWS service access without internet exposure
  • Secrets Manager: Credentials never leave your account

You own the infrastructure, the data, and the encryption keys.

Graceful Degradation​

AxonFlow continues operating when components fail. If the database is temporarily unavailable, audit logs buffer to local storage. If an LLM provider is down, requests route to alternatives.

  • Retry with Backoff: Transient failures are automatically retried with exponential backoff
  • Local Fallback: Audit logs persist locally if database is unavailable, then flush when connectivity returns
  • Circuit Breakers: Unhealthy components are isolated to prevent cascading failures
  • Stateless Agents: Any agent instance can handle any request -- no sticky sessions required

Real-Time Configuration​

Policies, connector configurations, and routing rules can be updated without redeploying AxonFlow or your applications. Changes take effect immediately.

  • Hot Reload: Policy changes are picked up automatically via the orchestrator API
  • Feature Flags: Enable/disable capabilities without code changes
  • Dynamic Routing: Add or remove LLM providers without restart

Observability​

AxonFlow exposes Prometheus metrics and provides pre-built Grafana dashboards for monitoring AI agent behavior in production.

Metrics:

  • Request latency (P50, P95, P99) per endpoint
  • Error rates by endpoint and policy
  • Throughput (requests/second)
  • LLM token usage and cost per provider

Health Monitoring:

  • /health endpoints on agent (port 8080) and orchestrator (port 8081)
  • Connector status per MCP integration
  • LLM provider availability and response times

Getting Started​

Self-Hosted (Community Edition):

git clone https://github.com/getaxonflow/axonflow.git
cd axonflow
docker compose up
# Agent API: http://localhost:8080
# Orchestrator API: http://localhost:8081

Try it now -- send a query to the agent API:

curl -X POST http://localhost:8080/api/v1/query/execute \
  -H "Content-Type: application/json" \
  -H "X-Client-Id: my-tenant" \
  -H "X-Client-Secret: your-client-secret" \
  -d '{
    "query": "What are the top 3 hotels in Tokyo under $200/night?",
    "context": {
      "user_id": "demo-user",
      "session_id": "quickstart-1"
    }
  }'

The agent enforces policies, routes to your configured LLM provider, and returns the response with audit metadata:

{
  "response": "Here are the top 3 hotels in Tokyo under $200/night...",
  "context_id": "ctx_7f2a1b",
  "policies_evaluated": 3,
  "latency_ms": 847
}

AWS Marketplace (Enterprise): Deploy via one-click CloudFormation -- see Deployment Guide.

Evaluation Tier​

The free Evaluation tier unlocks capabilities beyond Community for teams doing serious pre-production validation. Register at getaxonflow.com/evaluation-license to receive a key -- no credit card, no sales call.

  • HITL Approval Gates -- Route high-risk AI decisions to a human approval queue with up to 100 pending requests and 24-hour auto-expiry
  • Policy Simulation & Impact Report -- Dry-run policies against live inputs (300/day) and test a single policy against batches of sample inputs to see match/block rates before deploying
  • Evidence Export Pack -- Export bundled audit logs, workflow steps, and HITL approvals as JSON for internal reviews (14-day window, watermarked)
Free for Evaluation

These features are designed for teams evaluating AxonFlow before production. Set AXONFLOW_LICENSE_KEY on your server and restart -- all Evaluation features activate immediately alongside the elevated resource limits.

Community vs Enterprise​

CapabilityCommunityEnterprise
Sub-10ms policy enforcementIncludedIncluded
Policy-as-code (Rego/OPA)IncludedIncluded
PII detection and redactionIncludedIncluded
SQL injection scanningIncludedIncluded
Multi-model LLM routingIncludedIncluded
MCP connectorsIncludedIncluded
Audit loggingIncludedIncluded
Graceful degradationIncludedIncluded
Multi-Agent Planning (MAP)--Included
Service Identity--Included
Compliance dashboards--Included
Customer Portal UI--Included
Multi-region deployment--Included
AWS Marketplace one-click deploy--Included
Dedicated support and SLAs--Included
Enterprise Edition

Enterprise adds Multi-Agent Planning, Service Identity, compliance dashboards, Customer Portal UI, multi-region deployment, and dedicated support with SLAs.

Compare Editions | Request Demo | AWS Marketplace

Next Steps​

Last updated on