Features
Endpoint Governance
Endpoint governance is the shared control layer for every Eden endpoint. It covers how callers are authenticated, how endpoint access is granted, how backend credentials are isolated, how requests are routed through Gateway, and what audit evidence is recorded.
Provider-specific pages document the controls that apply to a particular endpoint kind. The baseline governance model applies across databases, LLMs, applications, servers and APIs, platforms, agents, and Gateway native gateway listeners.
Shared Controls
| Control | What it does | Primary surface |
|---|---|---|
| Endpoint registry | Stores endpoint identity, kind, description, backend profile, and provider-specific connection config. | /api/v1/endpoints |
| Control-plane RBAC | Controls who can view, configure, promote, grant, audit, or destroy endpoint configuration. | /api/v1/iam/control/endpoints/{endpoint} |
| Data-plane RBAC | Controls who can use the endpoint at runtime through shared read/write/execute permissions. | /api/v1/iam/data/endpoints/{endpoint} |
| Resource-specific grants | Allows endpoint, template, workflow, and API access to be granted without broad organization-wide rights. | RBAC APIs |
| Credential isolation | Keeps backend credentials in endpoint config or endpoint-level security assignments instead of clients. | Endpoint config, ELS |
| Templates | Define approved read/write/transaction shapes instead of arbitrary backend access. | /api/v1/templates |
| APIs | Publish governed endpoint-backed operations as stable API and tool surfaces. | /api/v1/apis |
| Workflows | Orchestrate endpoint, template, and API steps with policy, run state, and audit evidence. | /api/v1/workflows, /api/v1/workflow-runs |
| Native gateway runtime | Routes native protocol traffic through Gateway-managed interlay listeners with RBAC, masking, mirror, and telemetry controls in the path. | Gateway, /api/v1/interlays |
| Masking | Redacts or blocks configured request fields, arguments, or command surfaces before backend egress. | interlays.settings.masking |
| Backend profiles | Separates production and development backend lanes, credentials, routes, and pool budgets. | backend_profile, backend_pool_limits |
| Mirror mode | Sends eligible traffic asynchronously to secondary endpoints for comparison, migration, or validation. | interlays.settings.mirror |
| VPN transport | Allows WireGuard peers to reach selected Gateway native gateway listeners while Eden remains in the path. | /api/v1/vpn/* |
| Telemetry and audit | Records safe request, endpoint, policy, latency, and route evidence for operations and review. | Analytics and audit APIs |
Endpoint Families
| Family | Examples | Common governance notes |
|---|---|---|
| Databases | PostgreSQL, MongoDB, Redis, ClickHouse, Snowflake, Pinecone | RBAC, templates, APIs, workflows, database-appropriate masking, native gateway listeners where supported, and audit evidence. |
| LLMs | OpenAI, Anthropic, Ollama, OpenRouter, Azure OpenAI | Gateway keys, routing, PII governance, content profiles, access boundaries, and cost/route evidence. |
| Applications | Google Workspace, GitHub, GitLab, Datadog, PostHog, Salesforce, Tavily, Eraser | RBAC, templates, APIs, workflows, credential isolation, safe tool exposure, and audit evidence. |
| Servers, storage, and APIs | HTTP, S3, Lambda | RBAC, narrow operation shapes, credential isolation, templates, APIs, workflows, and audit evidence. |
| Platforms | AWS, Azure, Databricks | RBAC, provider-specific authentication, credential isolation, templates, APIs, workflows, and provider-specific controls where available. |
| Agents | Codex, Claude Code, Hermes, and compatible clients | Gateway key or native protocol configuration, safe work attribution, model policy, tool authorization, and promptless evidence. |
Request Lifecycle
- The caller authenticates through local Eden auth or a configured external identity provider.
- Eden resolves the organization, subject, endpoint, and requested action.
- Control-plane or data-plane RBAC is checked for the concrete endpoint or resource.
- Endpoint-level security, backend profile, native gateway listener, VPN, masking, mirror, template, API, or workflow policy is applied when configured.
- Gateway forwards the request using the endpoint's backend credentials, not client-held backend credentials.
- Eden records safe telemetry, audit, policy, route, and latency evidence.
Provider-Specific Governance
Some endpoint kinds add controls that are not meaningful for every backend. For example, cloud-platform endpoints can require provider-specific authentication and signing behavior, while agent endpoints can require a native protocol or OpenAI-compatible gateway configuration.
Those provider-specific controls build on the same endpoint governance layer rather than replacing it.
Native Gateway Runtime
Interlay listeners are part of the Gateway capability. They are the native protocol runtime Gateway uses when a client must speak the backend protocol directly while Eden still owns identity, endpoint policy, credential isolation, masking, mirror behavior, migration evidence, and telemetry.
Endpoint governance documents the controls Gateway applies through that runtime. It does not treat interlay listeners as a separate feature or product from Gateway.