Your Cloud. Your Kubernetes. Your Data Center. Nothing Hosted.
Everything runs inside your environment. Exactly one thing crosses the wall: model calls you approved, through a gateway you own, on keys you hold. No hosted service, no hybrid shortcut, no data path out.
Where Does It Run, and What Crosses the Line?
AWS, Azure or Google Cloud, in your subscription. Deployed as workloads your security team can see, under your network and your controls.
Your clusters, your network policy, your secrets. Workspace images are certified with your platform team.
Beside the systems that have no API, so a Workspace reaches a mainframe without a hop outside.
One security review. Not one per vendor.
Because Ariad is installed as software in your account, your security team reviews it the way they review any workload: your IAM, your network policy, your secrets management, your retention. Nothing about the way agents act asks for an exception to those controls, and nothing about it lives outside them.
- The eight controls are what your existing controls already see: identities you issued, contracts checked before an action, every action signed
- Under Complete, our specialists work on identities you issue and can revoke, on the same audit trail as everyone else
Any model you choose. One governed door for the traffic.
The only thing that leaves your environment is a model call, and only to a model on your approved list, on your keys. Models are assigned per agent by risk and cost, follow your list when it changes, and open-weight models you host count the same as hosted ones.
- Shipped: the approved-model registry, per-agent assignment and pinning
- Emerging, and marked that way: a gateway console with door-level coverage of all model traffic in the enterprise
Approved architecture in. Reviewed Terraform out. In your own cloud.
The environment Ariad runs in is built and changed the same way the work is: under review. Automate generates and maintains the Terraform for it, in your cloud, connected to your source control. Start from an existing repository, an interview or a template; every path ends as a pull request a person reviews.
- A guided interview sets cloud, regions, environments and structure, in AWS, Azure or Google Cloud
- Pre-approved Terraform modules, NIST 800-53 compliant and aligned to your security policies through your own scanning service; anything standalone can be blocked
- AWS, Azure and Google Cloud
- GitHub connection
- SSO with Google or Microsoft
- Self-hosted in your environment
- Pre-approved Terraform modules
- AI chat in ask, agent and plan modes
- Change review, file by file
Aligned to the Frameworks Your Auditors Use.
BSC builds and operates to the control frameworks regulated enterprises are held to. One security review, inside your walls, against the frameworks you already answer to.
In Your Words.
Is there a SaaS or hosted option?
No. Ariad is installed in your environment. That is a design decision, not a deployment option.
How do agents authenticate?
Each agent gets its own identity from your identity provider. Where policy disallows agent accounts, scoped tokens keep the boundary and people execute the sensitive steps.
Can our security team see what the platform is doing?
Yes. Workloads in your environment, every action in the evidence pack. Under Complete, our specialists appear in your evidence like everyone else: named, permissioned, recorded.
Does Automate apply infrastructure changes by itself?
No. Every path ends in a Terraform plan and a pull request a person reviews. There is no direct apply from an agent.