RADAR Architecture
RADAR is a self-hosted compliance evidence layer. It monitors existing agent workflows, records reviewable evidence, and keeps data inside your infrastructure without owning execution.
System boundary#
RADAR deploys beside your application, LLM gateway, tools, and observability stack. It captures prompts, completions, tool events, policy signals, PII signals, and review records so legal, security, and compliance teams can reconstruct what happened.
Design principles#
Independent evidence
RADAR observes and records. It does not execute, orchestrate, or replace the customer workflow engine.
Self-hosted by default
Evidence storage, retention, and exports stay inside the customer infrastructure for VPC, on-prem, and air-gapped evaluations.
Audit-ready records
Traces are structured for review, SIEM export, retention controls, and regulator-facing evidence packs.
Evidence flow#
1. Observe
Connect RADAR to the agent stack, LLM gateway, and tool activity streams.
2. Record
Normalize activity into trace, policy, PII, review, and retention records.
3. Export
Send evidence to SIEM, audit packs, data warehouses, and internal review workflows.