System Architecture
AgentWitness infrastructure — Vercel Edge + Amazon Aurora PostgreSQL (pgvector + RLS) + DynamoDB hot path.
Server-side rendered dashboard with client-side polling every 3 s. Semantic search, live agent stream, compliance PDF export, and causal graph all driven from real Aurora data.
26 API routes. Every action is persisted to Aurora with embeddings. Policy engine evaluates each action before insertion. Compliance PDF generated from live DB queries via pdfkit.
Primary store for all agent actions, policies, and trust scores. HNSW index on embedding column for sub-millisecond cosine similarity search.
Writes mirrored from every Aurora insert for <10 ms live stream latency. Polled every 3 s by the Live Stream page. Never blocks Aurora writes.
Generates semantic embeddings for every ingested action. Local SHA-256 PRNG fallback ensures ingestion never blocks on API unavailability.
PostgreSQL RLS policies on agents, policies, and agent_actions enforce true multi-tenant data isolation at the database layer — not the application layer.
-- RLS automatically filters all queries
Every agent action is embedded into a 1536-dim vector and stored in Aurora. HNSW index enables ANN search with cosine similarity. Judges can search “unauthorized access” and find relevant incidents semantically.
-- HNSW cosine distance
Each ingest call fetches active policies from Aurora and evaluates the action before insertion. Three rule types: cost_limit, data_masking (PII detection), and domain_block. Blocked actions are still written for full audit trail fidelity.
-- persisted with policy_id FK
POST /api/simulate generates realistic agent activity on demand (70% allowed / 20% blocked / 10% flagged). Events flow Aurora → DynamoDB → Live Stream within 3 seconds. Toggle auto-simulation on the Live Stream page.
The compliance package generator queries Aurora for live governance metrics, agent trust scores, and recent incidents. PDFKit renders a 10-page enterprise report (SOC 2 / EU AI Act / ISO 27001) using the actual database state at generation time.
POST /api/simulate/seed (protected by bootstrap token) inserts 300 backdated events spread across the last 7 days, including local embeddings, ensuring all dashboard pages show populated data for the demo.
| Layer | Technology | Purpose | Demo Relevance |
|---|---|---|---|
| Frontend | Next.js 15 / React 19 | Dashboard UI, SSR, API routes | Live updating without page refresh |
| Database | Amazon Aurora PostgreSQL | Primary data store, RLS isolation | Proves real multi-tenant DB usage |
| Vector DB | pgvector (Aurora extension) | 1536-dim embedding storage + HNSW ANN | Semantic search on agent intent |
| Cache | Amazon DynamoDB | Hot-path event mirror, <10 ms reads | Live stream latency demo |
| AI | OpenRouter (text-embedding-3-small) | Semantic embedding generation | Powers semantic anomaly search |
| PDFKit 0.19.1 | Compliance report generation | Live Aurora data → 10-page PDF | |
| Auth | PostgreSQL RLS policies | Row-level tenant isolation | Multi-tenant data isolation proof |
| Hosting | Vercel (Serverless) | Edge deployment, zero-config | Production-grade infra |