WAIOS Technical Reference Architecture
A high-level view of how WAIOS separates customer authority, operational intelligence, governance, execution, and evidence.
Two trust boundaries
AWS IAM / AWS STS describe the high-level direction for future external AWS onboarding. Exact policies, role identifiers, and permission sets are intentionally not published.
Hub / Master and Spoke
WAI Ecosystem is the current internal live reference environment. External enterprise Spoke onboarding is roadmap. Tenant-scoped RBAC and isolation are in development. Azure and Google Cloud connectivity remain roadmap.
External enterprise onboarding is blocked until tenant isolation and identity-bound authorization / RBAC are implemented and verified. Each tenant must retain its own identity → policy → CMDB → credentials → execution → BlackBox boundary, with tenant-scoped KEDB access. AI reasoning, retrieval, execution context, and operational evidence must never cross that boundary.
Why the boundary matters
Customer ownership
Infrastructure and access remain under customer control.
Revocable access
Connectivity is designed around scoped, revocable identity—not permanent root credentials.
Explicit authority
Identity and policy determine whether an action may execute.
Bounded AI
AI prompts are never the authorization or tenant-isolation boundary.
Three operational knowledge layers
This page explains boundaries and guarantees, not implementation mechanics. Internal schemas, risk formulas, orchestration logic, remediation algorithms, role policies, prompts, and security-sensitive APIs remain confidential.