Partner Deployment Reference
This section consolidates the partner-enablement and operational reference content that accompanies AgentWatch deployments — sized for deployment-partner organizations (e.g., systems integrators, MSPs) who stand up AgentWatch on behalf of end customers.
47.1 Seven Enterprise Use Cases (Out-of-the-Box)
Section titled “47.1 Seven Enterprise Use Cases (Out-of-the-Box)”| Use case | Problem | How AgentWatch solves it |
|---|---|---|
| Data leakage | Customer-support agent inadvertently sends SSN, credit card, or medical data in prompts. Without controls: HIPAA / PCI fine. | Inline DLP scans every prompt before the upstream provider sees it; blocks or redacts per policy. PII / PHI / PCI / secrets detection on by default for the relevant compliance frameworks. |
| Cost runaway | Dev team experiments with AI, costs balloon from $150 to $11K/month before anyone notices. | Per-team and per-user budgets in real time with hard limits (request-blocking, not just alerts) plus 80% / 90% / 100% alerts. Budget efficiency leaderboards surface outliers early. |
| Audit & compliance | Compliance officer needs to demonstrate every AI interaction with PII in the last 90 days. Without governance: “we don’t have that data.” | Full prompt / response / tool-call trail with DLP-redaction metadata, 365-day default retention, JSON/CSV/PDF export, framework-selector activation of GDPR / HIPAA / SOX / PCI-DSS / SOC 2 / ISO 27001 / HITRUST. |
| Vendor lock-in | OpenAI outage takes down all customer-facing AI features. Or: a compliance team demands the EU data goes through Mistral instead of OpenAI, but the application is written against the OpenAI SDK. | 14+ providers with automatic failover (circuit-breaker + priority fallback). Cross-protocol translation (§3.6): an app written against the OpenAI SDK can be re-routed to Anthropic Claude / AWS Bedrock / Google Vertex AI / Azure OpenAI / Mistral / DeepSeek upstream with zero application code changes — the gateway translates the request and response bodies. Same applies to Vertex SDK, Azure SDK, and Cohere V2 SDK as inbound formats. |
| Shadow AI | Developers using personal API keys, no governance, data leaving the corporate boundary. | SSO-enforced access via IdP (Okta / Entra / Google / SAML / LDAP / SCIM) plus centralized ak_… API-key issuance. Transparent-proxy topology eliminates shadow AI entirely (DNS-level interception). |
| Agent / MCP observability | Multi-agent systems make hundreds of tool calls per session — no way to attribute or audit individual calls. | Every MCP tool call logged with request / trace IDs for end-to-end tracing; OTLP export to any compatible APM; per-server uptime / error / latency monitoring independent of LLM execution. |
| LLM cost optimization | Repetitive queries (FAQ-style support, common code completions) waste tokens. | Semantic caching via LanceDB returns cached responses for similar prompts — 20–40% cost reduction on repetitive workloads. Prompt caching passthrough (up to 90% reduction on Anthropic for cache hits) on top. |
47.2 Vendors & Licensing
Section titled “47.2 Vendors & Licensing”| Component | License | Notes |
|---|---|---|
| AgentWatch | Iterate commercial | Per tenant / per user pricing |
| Node.js | MIT | Bundled runtime |
| Bun | MIT | Bundled runtime (1.3.14) |
| PostgreSQL | PostgreSQL License | OSS, no fees |
| Apache Kafka | Apache 2.0 | OSS, no fees |
| ClickHouse | Apache 2.0 | OSS, no fees |
| LanceDB | Apache 2.0 | OSS, embedded |
| HAProxy | GPL v2 | OSS |
| Presidio (Microsoft) | MIT | OSS, DLP / NER engine |
| spaCy | MIT | OSS, NLP model loader |
| Prisma | Apache 2.0 | OSS, ORM |
| tree-sitter | MIT | OSS, AST parser |
| Semgrep | LGPL 2.1 | OSS, SAST scanner |
| Trivy | Apache 2.0 | OSS, SCA / secrets / IaC scanner |
| LLM providers | Customer-owned | OpenAI, Anthropic, Bedrock, Vertex AI, Azure OpenAI, etc. |
| Cloud infrastructure | Customer-owned | AWS, GCP, Azure, on-prem |
| OIDC IdP | Customer-owned | Okta, Entra ID, Keycloak, Google Workspace, Auth0 |
No proprietary OSS fees: every bundled OSS component is permissively licensed; AgentWatch ships them inside the container with no per-component royalty obligation.
47.3 Ownership & Responsibilities (Customer / Partner / Iterate)
Section titled “47.3 Ownership & Responsibilities (Customer / Partner / Iterate)”A clear shared-responsibility model for deployments where a systems-integrator partner (e.g., WWT, Accenture, Deloitte) stands up AgentWatch for an end customer.
| Layer | Customer | Partner | Iterate.ai |
|---|---|---|---|
| Cloud / infra (VMs, network, storage) | Owns | Provisions | — |
| OS patching, image hardening | — | Owns | Guidance |
| AgentWatch deploy (Docker / Helm) | — | Executes | Provides artifacts |
| AgentWatch software upgrades | Approves | Applies (rolling) | Releases + notes |
| Tenant / policy / user config | Owns | Onboarding assistance | Templates |
| LLM provider keys & spend | Owns | — | — |
| L1 / L2 support | — | Owns | — |
| L3 engineering support | — | Escalates | Owns |
| Incident response (security) | Co-owns | Front-line | Engineering |
| Backup / DR runbook execution | — | Owns | Reviews |
47.4 Repeatable Deployment — New Region or Country (7 Steps)
Section titled “47.4 Repeatable Deployment — New Region or Country (7 Steps)”Standing up AgentWatch in a new region follows the same seven steps regardless of cloud or geography. An experienced partner can complete a non-HA install in half a day; a full HA Tier-2 deployment takes 2–3 days including observability wiring.
| Step | Action | Details |
|---|---|---|
| 1 | Provision infrastructure | VMs or Kubernetes cluster sized per the tier table (§39). Terraform-friendly; sample modules available on request. Standard networking: 1 GbE, SSD storage, x86_64 or ARM64. |
| 2 | Stand up data services | Managed PostgreSQL 14+ (RDS, Cloud SQL, Azure Database for PostgreSQL, or Supabase). Object-storage bucket (S3, GCS, Azure Blob) for long-term audit archive. Optional: Kafka cluster if Tier 2. |
| 3 | Deploy AgentWatch | helm install agentwatch ./helm/agentwatch or docker compose -f docker-compose.full.yml up -d. Helm chart includes app, optional Postgres sidecar, Kafka, and ClickHouse. |
| 4 | Wire up SSO | Configure OIDC issuerUrl pointing at customer IdP (Okta, Entra ID, Keycloak, Google Workspace). Single env-var change — provider-agnostic. Optionally configure SAML or LDAP via the Unified Auth Wizard. |
| 5 | Seed configuration | Tenants, providers, API keys, routing rules, and policies via JSON files in config/ (Git-version-controlled) or via REST API. Programmatic seeding scripts included. |
| 6 | DNS + egress | Point app DNS at the load balancer. Configure egress route to LLM providers — direct, via Zscaler/corporate proxy, or via Equinix/colo dedicated path. |
| 7 | Smoke test | Run the included Postman collection (AgentWatch_Test_Collection.postman_collection.json). Validates proxy, DLP, audit, MCP, and webhook flows end-to-end. |
47.5 Partner Enablement Checklist
Section titled “47.5 Partner Enablement Checklist”Use before standing up AgentWatch for a customer. Each item should have a confirmed owner and target date.
- Target tier confirmed (Small / Medium / Large — see §39 sizing table)
- Cloud and region selected; network topology mapped
- Egress pattern decided (direct / Zscaler / Equinix / customer-hosted inference)
- OIDC IdP details obtained (issuer URL, client ID, client secret)
- LLM provider accounts and keys procured by customer
- PostgreSQL 14+ instance available (managed preferred for Tier 2 / 3)
- Object-storage bucket provisioned for audit archive
- DNS records prepared for app + admin endpoints
- TLS certificates available (or load balancer will terminate)
- Backup and DR policy agreed (RPO, RTO, retention period)
- Observability targets identified (OTLP endpoint, Grafana / Datadog / Langfuse)
- Smoke-test runbook reviewed (Postman collection)
- Customer admin user identified for initial config handoff
- L1 / L2 support process documented between partner and customer
- L3 escalation path to Iterate documented (contact, SLA)
- Software upgrade cadence agreed (quarterly recommended)
47.6 FAQ — Common Partner Questions
Section titled “47.6 FAQ — Common Partner Questions”| Question | Answer |
|---|---|
| Does AgentWatch need GPUs? | No. LLM inference happens at the upstream provider (or on customer-hosted inference). AgentWatch is application-tier software — CPU/RAM only. |
| How many racks / nodes? | Small: 1 VM. Medium: 2 VMs (app + DB). Large: 5–7 VMs across app, Postgres, Kafka, ClickHouse. None are rack-scale — they fit comfortably in a single half-rack or cloud availability zone. |
| Single-tenant or multi-tenant? | Multi-tenant by default. Single-tenant is a multi-tenant deployment with one tenant configured — same binary, no separate build. |
| How do I scale? | Add stateless app replicas behind the load balancer for horizontal scale within a region. Replicate the full pod only for regional DR or data-residency requirements. |
| How do I upgrade? | Rolling upgrade of stateless app replicas behind the LB — zero downtime. Postgres migrations are backward-compatible across one minor version. SQLite schema drift is self-healed at boot. |
| What ports need to be open? | Inbound 443 (HTTPS), optional 80 → 443 redirect. Outbound 443 to LLM provider domains. Optional inbound on database / Kafka / ClickHouse ports for internal connectivity. |
| Can I bring my own database? | Yes. Point DATABASE_URL at your managed PostgreSQL 14+. SQLite is the alternative for small / edge deployments. |
| Can I bring my own observability stack? | Yes. OTLP-compatible — point at Grafana / Tempo / Datadog / Honeycomb / New Relic / Splunk / Jaeger / Zipkin, or any OTel-receiver. |
| Is there an air-gapped install? | Yes. All container images can be pulled to an internal registry (Harbor, JFrog, ECR, ACR). No call-home required. Customer-hosted inference (vLLM / TGI / Triton / Ollama) recommended for full air-gap. |
| Is there a Terraform provider? | JSON config files are the current source of truth (Git-versionable). Native Terraform provider is on the roadmap. Provisioning via REST API works today. Helm chart at helm/agentwatch/ works with Terraform’s helm provider out of the box. |
| Is there a Postman / Newman test suite? | Yes — AgentWatch_Test_Collection.postman_collection.json (~1.2 MB) covers proxy, DLP, audit, MCP, SSO, SCIM, and webhook flows end-to-end. Run via the included newman-runner.sh script in CI. |
| What’s the SLA? | Customer-deployment-specific — defined by the customer’s own infrastructure SLO. AgentWatch software itself has no inherent downtime; HA is achieved via replicas and database replication. |
| How does pricing work? | AgentWatch is licensed per tenant / per user. Cloud infrastructure and LLM provider costs are customer-owned. Sample cloud-cost ranges are in §39. |
| Does demo mode interfere with real data? | No. Demo mode is per-user toggleable and is on by default for new installs — admins can turn it off globally at production cutover. The seeded demo data and the real audit/usage tables are kept separate. |