Component Library
Building blocks with a real architectural contract.
Each of the 19 components declares its inputs, outputs, dependencies, security and data requirements, supported providers, operational needs and cost - so composition is deliberate, not guesswork.
AI
4LLM Gateway
Unified entry point for model access, routing, quota and observability.
LLM Gateway
Unified entry point for model access, routing, quota and observability.
- Inputs
- Prompt / messagesModel policyIdentity context
- Outputs
- Completion / streamToken usageTrace span
- Dependencies
- IdentityModel providerObservability
- Security
- Per-caller authPrompt / output logging controlsRate limiting
- Data
- Prompt data classificationRetention policy
- Providers
- OpenAIAnthropicAzure OpenAIBedrockVertex AI
- Operations
- Latency SLOToken budgetingFallback routing
- Config
- Model routing tableTimeout & retryGuardrail hooks
- Cost characteristics
- Per-token inference plus gateway compute.
RAG Retriever
Retrieval-augmented context assembly over an enterprise knowledge base.
RAG Retriever
Retrieval-augmented context assembly over an enterprise knowledge base.
- Inputs
- QueryFilters / ACLsTop-k
- Outputs
- Ranked chunksCitationsRetrieval trace
- Dependencies
- Vector storeEmbedding modelEnterprise search
- Security
- Row / document-level ACLsTenant isolation
- Data
- Source lineageChunking policyFreshness
- Providers
- pgvectorOpenSearchPineconeAzure AI Search
- Operations
- Recall monitoringIndex refresh cadence
- Config
- Chunk size / overlapRerankingScore threshold
- Cost characteristics
- Vector storage plus embedding and query compute.
Agent Orchestrator
Coordinates multi-step agent runs with tools, memory and approval.
Agent Orchestrator
Coordinates multi-step agent runs with tools, memory and approval.
- Inputs
- Goal / taskTool registryAgent identity
- Outputs
- Action planTool callsResult + audit trail
- Dependencies
- LLM GatewayToolsMemoryApproval
- Security
- Scoped agent permissionsHuman-in-the-loop gates
- Data
- Working memoryTask state
- Providers
- Framework-neutral
- Operations
- Run tracingRetry & fallbackCost caps per run
- Config
- Max stepsApproval thresholdsTool allowlist
- Cost characteristics
- Inference plus tool-execution compute.
Guardrail
Policy checks on inputs and outputs before they reach users or tools.
Guardrail
Policy checks on inputs and outputs before they reach users or tools.
- Inputs
- Model input / outputPolicy set
- Outputs
- Allow / block / redactViolation event
- Dependencies
- LLM GatewayAudit
- Security
- PII detectionInjection defenseContent policy
- Data
- Classification tagsRedaction rules
- Providers
- Provider-neutral
- Operations
- Violation dashboardsPolicy versioning
- Config
- Policy rulesAction per severity
- Cost characteristics
- Lightweight per-request evaluation.
Data
4Ingestion Pipeline
Moves data from operational sources into the platform under contract.
Ingestion Pipeline
Moves data from operational sources into the platform under contract.
- Inputs
- Source connectorsSchedule / eventData contract
- Outputs
- Landed raw dataIngestion metrics
- Dependencies
- Data sourcesObject storage
- Security
- In-transit encryptionCredential vaulting
- Data
- Schema contractFreshness SLAClassification
- Providers
- AirbyteFivetranGlueData Factory
- Operations
- BackfillFailure retriesLag monitoring
- Config
- Sync modeCursor fieldContract enforcement
- Cost characteristics
- Connector runtime plus transfer volume.
Lakehouse
Unified storage layer for raw, refined and curated data.
Lakehouse
Unified storage layer for raw, refined and curated data.
- Inputs
- Landed dataTransformations
- Outputs
- Curated tablesLineage metadata
- Dependencies
- Object storageCatalog
- Security
- Table ACLsEncryption at rest
- Data
- Medallion zonesLineageQuality checks
- Providers
- DeltaIcebergHudi
- Operations
- CompactionRetentionCost tiering
- Config
- PartitioningFile formatTable properties
- Cost characteristics
- Storage plus transformation compute.
Data Warehouse
Query-optimized analytical store feeding the semantic layer and BI.
Data Warehouse
Query-optimized analytical store feeding the semantic layer and BI.
- Inputs
- Curated dataModels / marts
- Outputs
- Analytical tablesQuery results
- Dependencies
- LakehouseTransformation layer
- Security
- Role-based accessColumn masking
- Data
- MartsAggregatesData quality tests
- Providers
- SnowflakeBigQueryRedshiftSynapse
- Operations
- Warehouse sizingQuery monitoring
- Config
- Warehouse sizeAuto-suspendMaterializations
- Cost characteristics
- Compute credits plus storage.
Semantic Layer
Governed metrics and dimensions consumed consistently by BI.
Semantic Layer
Governed metrics and dimensions consumed consistently by BI.
- Inputs
- Warehouse tablesMetric definitions
- Outputs
- Governed metricsBI datasets
- Dependencies
- Data WarehouseBI
- Security
- Metric-level accessRow-level security
- Data
- Metric contractsDimension hierarchy
- Providers
- dbt Semantic LayerCubeLookML
- Operations
- Definition versioningCertification
- Config
- Metric definitionsAccess policies
- Cost characteristics
- Modeling plus query pass-through.
Enterprise
3API Gateway
Managed edge for enterprise APIs with auth, quota and routing.
API Gateway
Managed edge for enterprise APIs with auth, quota and routing.
- Inputs
- Client requestsRoute configAuth policy
- Outputs
- Routed responsesAccess logs
- Dependencies
- IdentityBackend services
- Security
- OAuth / OIDCWAF integrationRate limiting
- Data
- Request metadataAudit logs
- Providers
- API GatewayAPIMApigeeKong
- Operations
- Canary routingLatency SLO
- Config
- RoutesQuotasAuth scopes
- Cost characteristics
- Per-request plus data transfer.
Identity & SSO
Central identity for users, services and agents.
Identity & SSO
Central identity for users, services and agents.
- Inputs
- CredentialsFederation config
- Outputs
- TokensClaimsSession
- Dependencies
- DirectoryApplications
- Security
- MFAConditional accessLeast privilege
- Data
- Identity attributesAccess logs
- Providers
- Entra IDOktaCognitoKeycloak
- Operations
- Access reviewsToken lifecycle
- Config
- FederationRole mappingSession policy
- Cost characteristics
- Per-active-user licensing.
Workflow Engine
Durable orchestration for business and integration workflows.
Workflow Engine
Durable orchestration for business and integration workflows.
- Inputs
- Trigger eventWorkflow definition
- Outputs
- Executed stepsState history
- Dependencies
- ServicesNotification
- Security
- Scoped execution rolesSigned payloads
- Data
- Workflow stateAudit trail
- Providers
- Step FunctionsTemporalLogic Apps
- Operations
- Retry policyTimeout handling
- Config
- State machineRetry / catchTimeouts
- Cost characteristics
- Per-state-transition or worker compute.
Infrastructure
3Virtual Network (VPC)
Isolated network foundation with controlled connectivity.
Virtual Network (VPC)
Isolated network foundation with controlled connectivity.
- Inputs
- CIDR planSubnet design
- Outputs
- Network fabricRoute tables
- Dependencies
- Cloud accountConnectivity
- Security
- SegmentationSecurity groupsFlow logs
- Data
- Traffic metadata
- Providers
- AWS VPCAzure VNetGCP VPC
- Operations
- IP managementPeering / TGW
- Config
- SubnetsRoutesEndpoints
- Cost characteristics
- Mostly gateway and transfer charges.
Container Runtime
Scalable compute for services and agent runtimes.
Container Runtime
Scalable compute for services and agent runtimes.
- Inputs
- Container imageScaling policy
- Outputs
- Running tasksHealth signals
- Dependencies
- RegistryNetworkSecrets
- Security
- Task rolesImage scanningNetwork policy
- Data
- Config / secrets injection
- Providers
- ECSEKSAKSGKECloud Run
- Operations
- AutoscalingRolling deploys
- Config
- CPU / memoryMin / max replicasProbes
- Cost characteristics
- Per-vCPU / memory-hour.
Managed Database
Relational or NoSQL store with backup and HA.
Managed Database
Relational or NoSQL store with backup and HA.
- Inputs
- SchemaConnection policy
- Outputs
- Persisted dataRead replicas
- Dependencies
- NetworkSecretsBackup
- Security
- Private endpointsEncryptionIAM auth
- Data
- BackupsPITRClassification
- Providers
- RDS / AuroraAzure SQLCloud SQL
- Operations
- FailoverBackup / restoreScaling
- Config
- Instance classMulti-AZRetention
- Cost characteristics
- Instance-hours plus storage and IO.
Security
3Key Management (KMS)
Central management of encryption keys and cryptographic policy.
Key Management (KMS)
Central management of encryption keys and cryptographic policy.
- Inputs
- Key requestsRotation policy
- Outputs
- Managed keysAudit events
- Dependencies
- IdentityAudit
- Security
- Envelope encryptionKey policiesRotation
- Data
- Key usage logs
- Providers
- AWS KMSAzure Key VaultCloud KMS
- Operations
- Rotation cadenceAccess review
- Config
- Key policyRotation periodGrants
- Cost characteristics
- Per-key plus API calls.
Secrets Manager
Secure storage and controlled delivery of application secrets.
Secrets Manager
Secure storage and controlled delivery of application secrets.
- Inputs
- Secret valuesAccess policy
- Outputs
- Injected secretsAccess audit
- Dependencies
- KMSIdentity
- Security
- Encryption at restScoped accessRotation hooks
- Data
- Secret versionsAccess logs
- Providers
- Secrets ManagerKey VaultSecret Manager
- Operations
- Automatic rotationExpiry alerts
- Config
- Rotation lambdaResource policy
- Cost characteristics
- Per-secret plus API calls.
Zero-Trust Access
Identity-aware access enforcement across services and boundaries.
Zero-Trust Access
Identity-aware access enforcement across services and boundaries.
- Inputs
- Identity + device contextAccess policy
- Outputs
- Allow / denyAccess audit
- Dependencies
- IdentityNetwork
- Security
- Continuous verificationLeast privilegeMicro-segmentation
- Data
- Access decisionsPosture signals
- Providers
- Provider-neutral
- Operations
- Policy tuningAnomaly review
- Config
- Access policiesTrust signals
- Cost characteristics
- Per-user or per-gateway.
Operations
2Observability Stack
Logs, metrics and traces with dashboards and alerting.
Observability Stack
Logs, metrics and traces with dashboards and alerting.
- Inputs
- TelemetrySLO definitions
- Outputs
- DashboardsAlertsTraces
- Dependencies
- ServicesNotification
- Security
- Telemetry access controlPII scrubbing
- Data
- Retention tiersSampling
- Providers
- OpenTelemetryCloudWatchGrafanaDatadog
- Operations
- SLO trackingOn-call routing
- Config
- DashboardsAlert rulesSampling
- Cost characteristics
- Ingested volume plus retention.
Backup & DR
Backup, restore and failover to meet RTO / RPO targets.
Backup & DR
Backup, restore and failover to meet RTO / RPO targets.
- Inputs
- Backup policyDR plan
- Outputs
- BackupsRestore pointsFailover
- Dependencies
- DatabasesStorageNetwork
- Security
- Encrypted backupsIsolated recovery
- Data
- Restore pointsRecovery evidence
- Providers
- AWS BackupAzure BackupGCP Backup
- Operations
- Restore testingFailover drills
- Config
- ScheduleRetentionRTO / RPO targets
- Cost characteristics
- Backup storage plus egress on restore.