Eve

Eve is the gateway and unified API layer for Eden endpoints. It gives applications, services, users, and agents one governed path to databases, caches, APIs, tools, services, and model provider endpoints.

Use Eve when you want to centralize authentication, routing, endpoint credentials, policy enforcement, observability, and auditability instead of giving every client a direct path to every backend.

Eve can be used for AI when AI traffic is endpoint traffic to a model provider. Eve applies endpoint masking on supported interlay request surfaces; Adam adds the built-in LLM PII scanner and template lookup for governed AI traffic. Adam starts when the product experience is governed AI working against endpoints through the Eden LLM interface or tool-calling runtime.

What Eve Does

Eve sits between callers and production systems:

Apps, services, agents, operators
        |
        v
Eve gateway and API
        |
        +-- Model provider endpoints
        +-- Tools and functions
        +-- REST APIs and webhooks
        +-- Databases and caches

For every request, Eve can attach identity, organization context, endpoint permissions, routing decisions, policy outcome, telemetry, and cost or performance metadata.

Core Capabilities

Product Boundary With Adam

Eve features are endpoint and gateway-runtime features:

• endpoint onboarding and credentials,
• control-plane and data-plane RBAC,
• endpoint-level security,
• native protocol interlays,
• private network access such as Eden VPN,
• request masking and command policy,
• templates, APIs, workflows, and endpoint tools,
• endpoint telemetry and audit evidence.

Adam features are governed AI-over-endpoints features:

• licensed human, agent, or gateway API-key seats,
• Eden LLM interface and AI tool-calling runtime,
• OpenAI-compatible gateway policy,
• model routing and provider selection for AI requests,
• model-use budgets and cost attribution,
• LLM PII scanning and template-backed lookup, alongside Eve endpoint masking,
• promptless evidence and governance records.

When Adam calls an endpoint tool or saved template, Eve still enforces endpoint access. When Eve stores a model provider endpoint, that is still an Eve endpoint; Adam is the layer that lets users and agents use AI against those endpoints with model routing, tool calling, per-subject policy, and evidence.

Native Gateway Runtime

Eve's native gateway runtime is implemented through interlay listeners. An interlay is the managed listener for a protocol route, not a separate product from Eve.

Use this path when clients need to keep speaking a native backend protocol, such as Redis or a database protocol, while Eden still owns authentication, endpoint RBAC, endpoint-level security, masking, mirror behavior, and telemetry.

Endpoint Families

Eve is designed to manage different endpoint types through the same organization, authentication, RBAC, and API model.

See Endpoints for configuration details.

Request Lifecycle

A typical Eve request follows this path:

1. The caller authenticates as a human user, application, or agent.
2. Eve resolves the organization and endpoint.
3. Eve checks control-plane or data-plane permissions for the requested action.
4. Eve applies routing, policy, masking, budget, or command controls where configured.
5. Eve forwards the request to the backend using the endpoint's configured connection.
6. Eve records telemetry, audit context, and response metadata.

What Operators Configure

Operators usually configure:

• Organizations and bootstrap administrators.
• Human users, agent credentials, and token handling.
• Endpoint definitions and credentials.
• Control-plane and data-plane RBAC grants.
• Eve native gateway listeners when traffic must pass through a backend protocol listener.
• Policy, observability export, rate limits, templates, APIs, and workflows.

When Eve Is In The Critical Path

Eve is in the critical request path when applications, agents, or users connect to Eve instead of connecting directly to the backend. This is the model used for gateway access, native protocol proxying, command policy, and request analytics.

Because Eve can sit in the path of production traffic, treat endpoint onboarding as an operational change:

• Confirm endpoint health before moving clients.
• Grant least-privilege RBAC before exposing endpoints.
• Export telemetry before production rollout.
• Establish rollback and emergency bypass procedures for critical systems.

For DNS, private routing, load balancer, sidecar, and VPN placement patterns, see Deployment And DNS Architecture.

Related Docs

• Gateway Model
• Access And Policy
• Observability
• Deployment And DNS Architecture
• Endpoint Governance
• Eden VPN
• Traffic Masking
• Traffic Mirroring
• PII Redaction And Dictionaries
• Endpoint Backend Profiles
• Authentication
• Role-Based Access Control
• Endpoint Management
• API Overview
• Interlays API
• Gateway Capacity Planning