Skip to content

Architecture

The brain and the hands, kept apart

ai4all ingests third-party plugins without a trust hand-off escape. The reasoning engine is architecturally severed from the execution environment: a compromised tool runtime cannot reach the model's context, its credentials, or its decision loop.

Layer 1

Pre-execution firewall

Intercepts, audits, and permissions every request before a runtime exists. Schema assertion first — the cheap structural check — then argument inspection, then and only then a spawn.

Layer 2

microVM containment

Sandboxes external tools, MCP adapters, and integrations behind hardware virtualisation with their own guest kernel. A container shares the host kernel; a kernel escape there is a host escape.

Layer 3

Cognitive-executive separation

The model reasons on one side of the seam; execution happens on the other. Results cross back as data, and data is never permitted to act as instruction.

Pre-execution firewall

Seven rule families, and why each exists

A rule an engineer cannot explain is a rule they will eventually delete. Each of these carries its reasoning — and its known limits.

path-traversal
A relative segment walking above the intended root. Resolve, then assert containment inside an allow-listed directory.
shell-chaining
Shell control operators. Arguments should never reach a shell — pass argv to exec, never a command string.
command-substitution
Substitution syntax that executes in a shell or leaks the environment in a template.
env-exfiltration
Direct references to credential material or the process environment. Executors inherit no ambient secrets.
sql-pollution
Classic parameter pollution. Downstream stores bind parameters; they never concatenate.
prompt-injection
Instruction-shaped text inside an argument. Tool arguments are data, never direction.
remote-payload
Fetch-and-run of a remote script. Executors boot from a read-only image and download nothing at call time.

What a denylist cannot do

Pattern matching chases an unbounded space: encoding, nesting, and novel syntax routinely evade a fixed list. It is a useful tripwire and a terrible perimeter. The load-bearing controls are positive schema validation, an allow-list of permitted argument shapes, refusing to hand arguments to a shell at all, and least-privilege capability grants per call.

See the rules fire in the sandbox →

Statelessness

No sticky sessions, anywhere

Every request carries what it needs to be authorised and executed. There is no server-held session for a load balancer to pin — which is what makes replication to the edge, and eventually beyond it, tractable at all.

The rule

  • No sticky session identifiers written to cookies or host state.
  • Self-describing, cryptographically verifiable auth carried in headers.
  • Any node can serve any request; identical inputs, identical handling.

What it does not mean

  • It does not mean the host keeps no audit log — it keeps a thorough one.
  • It does not mean every call spawns a fresh process.
  • It does not mean memory is stateless. The backends are persistent; the host is not.

Erasure

The ghost vector problem

Under GDPR Article 17, soft-deleting a row is not erasure while its embeddings, caches, and derived indexes survive. A forget request has to fan out to every backend holding a derivative.

Fan-out routing

One erasure request resolves into per-backend operations: a hard delete here, an edge invalidation there, a page-out somewhere else.

Derivative sweep

Embeddings, summaries, and cached spans derived from the record are enumerated and removed alongside it — that is the part naive deletion misses.

Cryptographic erasure

For ephemeral session volumes, the key is destroyed rather than the ciphertext overwritten. Fast, and effective — provided no copy of the key escaped.

Request path

Four steps, end to end

  1. STEP 01

    Ingestion

    An application submits a multi-step request. It arrives as a self-describing payload — no session to resume.

  2. STEP 02

    Translation

    The request is normalised through the Model Context Protocol: JSON-RPC 2.0 envelope, declared tool schema, typed arguments.

  3. STEP 03

    Orchestration

    The hub resolves which backends can answer, translating between flat-vector and graph schemas, alongside A2A and AGNTCY routing.

  4. STEP 04

    Settlement

    Usage settles peer-to-peer over TODA/IP rails, with the receipt carried in the response rather than written to a shared ledger.

Position in the stack

Where the seam sits

Application layerThird-party enterprise apps and multi-agent research tools.
ai4all layerThe routing seam and universal adapter. Pre-execution firewall, schema translation, isolated executors.
Mosaic coreStateful sessions and secure distributed execution beneath.