A fail-closed gate on AI egress, backed by a signed decision

Software guardrails are advisory. Auditors want proof.

An in-process SDK or a prompt wrapper is something your developers can disable, forget, or route around — and when an incident happens, you have no cryptographic record that the control ever executed. Regulated buyers need an enforcement point that sits in the network path, fails closed, and produces evidence.

Envoy asks, EVE decides and signs, the sidecar verifies

Your egress traffic flows through Envoy. Envoy’s ext_authz filter calls the EVE Sidecar (gRPC on port 9002, or HTTP on 9001) before forwarding each request. The sidecar sends request metadata and digests to EVE’s control plane at POST /v1/decisions/authorize, gets back a signed eve.decision.v1, and checks the signature, issuer, tenant, request digest, expiry and replay nonce. Only a verified ALLOW returns OK; everything else returns PERMISSION_DENIED (HTTP 403) and Envoy never sends the request upstream.

An enforcement point that fails closed and checks the proof

Envoy in front, the sidecar beside it

The sidecar runs next to your application container as Envoy’s authorization service. The reference Envoy filter and a Helm chart are provided to design partners with the image. Your app tags each governed request with x-eve-provider and x-eve-model headers; a request without them is denied.

# Sidecar container — same pod as the app and Envoy
containers:
  - name: eve-sidecar
    image: <YOUR-REGISTRY>/eve-sidecar@sha256:<DIGEST>   # issued with your engagement;
                                                     # not on any public registry
    ports: [{ containerPort: 9002 }, { containerPort: 9001 }]   # gRPC / HTTP ext_authz
    env:
      - name: EVE_SIDECAR_CONTROL_PLANE_URL
        value: "https://api.eveaicore.com"
      - name: EVE_SIDECAR_TENANT_ID     # your tenant; never taken from the request
        value: "org_abc"
      - name: EVE_SIDECAR_AUTH_TOKEN    # control-plane bearer token (from a Secret)
        valueFrom: { secretKeyRef: { name: eve-sidecar, key: token } }
      - name: EVE_SIDECAR_PUBKEY        # EVE public key (PEM) used to verify decisions
        valueFrom: { configMapKeyRef: { name: eve-sidecar, key: pubkey.pem } }

# Envoy HTTP filter — deny if the sidecar is unavailable
- name: envoy.filters.http.ext_authz
  typed_config:
    # Required: without the type URL Envoy rejects typed_config.
    "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
    failure_mode_allow: false
    grpc_service: { envoy_grpc: { cluster_name: eve_sidecar_authz }, timeout: 3s }
    # Body forwarding stays OFF here, matching the shipped reference config.
    # Envoy passes NO body bytes to the sidecar unless you uncomment the
    # line below, which forwards up to 8 KiB of EVERY request. Enable it
    # only for content inspection, and read the data-minimisation rules first.
    # with_request_body: { max_request_bytes: 8192, allow_partial_message: true }

No Envoy? Call the decision API directly

Teams that don’t run Envoy can ask EVE for a decision in code with the eve-coreguard SDK (pip install eve-coreguard) or a plain HTTPS call to POST /v1/decisions/evaluate. The trade-off: an in-code check is only enforced if every caller makes it, which is exactly what the sidecar removes.

curl -X POST https://api.eveaicore.com/v1/decisions/evaluate \
  -H "Authorization: Bearer eve_<your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{"request_id": "req-001", "timestamp": "2026-06-02T00:00:00Z", "tenant_id": "org_abc", "user": {"id": "u_123", "role": "loan_officer"}, "proposed_action": {"type": "loan_approval", "amount": 50000}, "model_output": {"decision": "approve", "confidence": 0.9}, "context": {"credit_score": 720, "debt_to_income": 0.30, "employment_verified": true}, "policy_set": "lending_v1"}'
# -> {"decision": {"status": "ALLOWED"}, "risk": {"risk_level": "LOW"}, "audit": {"audit_id": "aud-001"}}

A thin relay in your pod. No engine to reverse-engineer.

What runs in your pod is a thin, stateless authorization relay — never the governance engine. Decisions are made by the EVE control plane, which runs as EVE-hosted SaaS; VPC, on-prem, and air-gapped deployments of the engine are available to design partners (early access).

What ships today, and what is coming

We are explicit about the current edges.