Security · The Grid
The control-plane proxy for all agent traffic: auth, rate limiting, kill-switch, audit.
The Grid is the AI control plane: the proxy every piece of agent traffic flows through, providing auth, rate limiting, the kill-switch, and audit. It is Layer 1 of the two planes.
What it does
| Capability | Why it matters |
|---|---|
| API Proxy Gateway | One controlled path to every core/critical system. No agent talks to a core directly. |
| Granular Keys | A key per vendor / agent / MCP instance → precise access control + per-connection behavioral baselines. |
| Grid Analytics | Real-time view of all AI activity for compliance officers and CTOs. |
| Kill-switch | Instant 2FA-protected disable of any key/connection. Disabled ≠ deleted, preserved for forensics. |
| Audit Trails | NCUA-examination-grade logging; member data hashed. |
The Grid is one of the four things the Runline Framework composite is made of, alongside the Tower, Circuit, and the Runner fleet.
Keys & Access
Granular key management: every vendor, agent, and MCP instance gets its own scoped key, so access is precise and every connection has a behavioral baseline. Keys tie into identity and rotate.
Kill-Switch
The kill-switch takes any agent or key off the Grid in sub-100ms, per-agent or per-key, available to CU staff directly (not gated behind Runline), fired behind 2FA. Disabled keys are preserved, not deleted, for forensics.
Audit & Compliance
Every agent action is recorded, attempted vs. approved vs. blocked, append-only, with the retention NCUA examinations require (auth → kill-switch → rate-limit → forward → audit). Each NCUA requirement and relevant SOC 2 criterion maps to a named architectural response, and member data is hashed.
Tenant Isolation
Org-scoping is the tenancy boundary: one credit union's data, members, and Runners are isolated from another's by construction (ADR-013). Identity, DNS, and the vault stay Runline-centralized; per-CU data residency is available where isolation requires it.
Learn more
- Circuit: the org nervous system that feeds the Grid
- Governance-First: gated autonomy and the NCUA mapping