Skip to content
FaradAiLab Docs
Enterprise Beta

Private Beta Onboarding Guide

The FaradAiLab Enterprise Edition Private Beta program is designed for enterprise security architects, CISOs, and platform engineering leads who need to establish centralized visibility and policy enforcement across fleets of AI coding agents and automated pipelines.

Deployment Topologies for Private Beta

Enterprise design partners can select from three evaluation deployment models depending on organizational compliance and network zoning requirements:

graph TD
    subgraph Option1 ["1. Managed SaaS (Fastest)"]
        SaaS_CP["wire.faradailab.com\n(Multi-Tenant Cloud Control Plane)"]
        SaaS_Edge["Enterprise Edge Fleet\n(mTLS over Public Internet)"]
        SaaS_Edge --> SaaS_CP
    end


    subgraph Option2 ["2. Dedicated Cloud Tenant (VPC Peering)"]
        VPC_CP["Isolated FaradAiLab Enterprise Edition Instance\n(Single-Tenant AWS / GCP)"]
        VPC_Edge["Corporate VPC Workloads\n(AWS PrivateLink / Peering)"]
        VPC_Edge --> VPC_CP
    end


    subgraph Option3 ["3. Self-Hosted Air-Gapped (On-Premises)"]
        Self_CP["Enterprise Kubernetes Cluster\n(Customer Datacenter / Helm)"]
        Self_Edge["Internal Agent Runners\n(Internal Network Only)"]
        Self_Edge --> Self_CP
    end

1. Managed Multi-Tenant SaaS

  • Fastest Time to Value (<1 hour): Secure multi-tenant SaaS control plane hosted at wire.faradailab.com.
  • Zero Infrastructure Overhead: FaradAiLab manages control plane availability, database backups, and certificate authorities.
  • Security: Complete tenant isolation enforced via PostgreSQL Row-Level Security (RLS) and customer-controlled KMS BYOK keys.

2. Dedicated Cloud Tenant (VPC Peering / PrivateLink)

  • Network Isolation: Dedicated single-tenant control plane deployed within an isolated AWS or GCP VPC.
  • Private Connectivity: Connected directly to your corporate network via AWS PrivateLink, Transit Gateway, or VPC Peering with zero public IP exposure.

3. Self-Hosted Air-Gapped (Helm / Kubernetes)

  • Full Sovereignty: Deployed directly within your Kubernetes clusters (EKS, GKE, OpenShift) via Helm charts.
  • Strict Air-Gap Support: Designed for defense, banking, and critical infrastructure environments with zero egress to the public internet.

Evaluation Prerequisites Checklist

Before beginning your private beta pilot, ensure your team has the following prerequisites in place:

  • Agent Fleet Scale Identification: Number of target developer workstations (Cursor, Claude Code, Windsurf) and automated CI/CD runners.
  • Identity Provider (IdP): Access to an enterprise IdP (Okta, Microsoft Entra ID / Azure AD, Google Workspace) with permission to configure a SAML 2.0 or OIDC application.
  • KMS Access (Optional for BYOK): IAM permissions in AWS KMS, GCP Cloud KMS, or HashiCorp Vault to provision a dedicated Key Encryption Key (KEK).
  • SIEM / Telemetry Destination: Target endpoint for log forwarding (Splunk HEC URL + token, Datadog API key, or Kafka broker cluster).
  • Network Connectivity: Ability for edge workstations or container runners to establish outbound HTTPS (Port 443) or mutual TLS (Port 8443) connections to the control plane.

5-Step Pilot Onboarding Flow

sequenceDiagram
    autonumber
    actor SecAdmin as Enterprise SecOps
    participant CP as FaradAiLab Enterprise Edition Control Plane
    participant IdP as Corporate IdP (Okta/Entra)
    actor Dev as Developer / Runner
    participant PEP as Edge FaradAiWire PEP


    SecAdmin->>CP: Provision Workspace & Configure KMS BYOK
    SecAdmin->>IdP: Authorize SAML 2.0 / OIDC Federation
    SecAdmin->>CP: Issue Fleet Enrollment Token & Rego Bundles
    Dev->>PEP: Install Fleet Daemon & Enroll with Token
    PEP->>CP: Perform mTLS Handshake & Fetch OPA Bundle
    Note over PEP,CP: Edge node is now actively governed and streaming telemetry

Step 1: Workspace Provisioning & KMS Setup

Upon beta approval, your security administrator receives an onboarding link to provision your dedicated enterprise workspace. If using KMS BYOK, provide your KMS Key ARN or Vault path. The control plane validates key access and sets up tenant cryptographic boundaries.

Step 2: SSO & SCIM Configuration

Configure SAML 2.0 or OpenID Connect in your identity provider. Assign your engineering, security, and auditor groups. SCIM 2.0 synchronizes user membership and automatically revokes access when team members change roles.

Step 3: Policy Bundle Authoring

Load your organization’s initial security baseline into the OPA Policy Studio. You can start with our pre-built compliance templates:

  • Strict Developer Sandbox: Blocks terminal command execution targeting production Kubernetes clusters.
  • DLP Secret Masking: Enforces masking of corporate API keys, AWS credentials, and PII across all agent responses.
  • Database Guard: Prevents agents from running unparameterized DDL or DROP statements against development databases.

Step 4: Fleet Daemon Enrollment

Distribute the lightweight Fleet Gateway Daemon to target machines using your MDM (Jamf, Intune, Munki) or Docker/Kubernetes manifests:

Terminal window
# Example developer enrollment via terminal
curl -fsSL https://get.faradailab.com/ee/install.sh | sh
faradaiwire-ee enroll --token "faw_enroll_sec_99428fa8b21c40"

Step 5: Verification & Audit Monitoring

Open the FaradAiLab Enterprise Edition Live Fleet Monitor. You will immediately see enrolled nodes reporting their status, active policy versions, and sanitized tool invocations. Verify test alerts in your Splunk or Datadog dashboard.

Next Steps