How It Works

A technical deep dive for senior devs and tech leads who want to understand exactly how Control Zero secures your AI applications.

Smart SDK Architecture

The SDK runs in your application process, evaluating policies and managing secrets locally. This means zero latency overhead for valid requests.

📦

Local Policy Cache

Policies synced from control plane and cached locally. Evaluated in microseconds.

🔄

Smart Invalidation

Push-based updates via WebSocket. Changes propagate in under 1 second.

⚡

Zero Latency Path

Valid requests hit cache only. No network calls to Control Zero servers.

Request Flow

Every request goes through these steps — most happen in microseconds

1

Request Initiated

Your application calls the LLM through the Control Zero SDK wrapper.

2

Policy Check

Policies are evaluated locally from cache. No network call for valid requests.

3

Secret Injection

API keys are fetched (or from cache) and injected into the request headers.

4

Provider Call

Request goes directly to the LLM provider. Your data never touches our servers.

5

Async Logging

Response metadata is logged asynchronously. Zero impact on response time.

Policy Engine

Define granular access rules with conditions. Time-based, role-based, IP-based — all evaluated locally with default-deny security.

Example Policy

json
{
  "name": "production-access",
  "effect": "allow",
  "actions": ["llm:invoke"],
  "conditions": {
    "environment": "production",
    "time": {
      "after": "09:00",
      "before": "18:00",
      "timezone": "America/New_York"
    },
    "roles": ["senior-engineer", "ml-engineer"],
    "ip_ranges": ["10.0.0.0/8"]
  }
}

Time-based Rules

Restrict access to business hours. Great for controlling production access.

Role-based Access

Different permissions for different team members. Least-privilege by default.

IP Restrictions

Limit access to your VPN or office networks. Defense in depth.

Default Deny

If no policy explicitly allows an action, it's denied. Security by default.

Secret Lifecycle

How secrets are fetched, cached, injected, and wiped — all without ever touching your codebase.

Fetched

Secrets retrieved from Control Zero vault or connected provider (Vault, KMS)

Cached

Encrypted in memory with configurable TTL. Never written to disk.

Injected

Added to request headers just before the provider call is made.

Wiped

Cleared from memory on session end or TTL expiration.

Audit & Observability

ClickHouse-powered logging for blazing-fast queries. Every action tracked, with 1-year retention and full export capability.

📊

Async Batched Writes

Logs are batched and written asynchronously. Zero impact on your application performance.

⚡

ClickHouse Powered

Billions of logs queryable in seconds. Perfect for compliance and debugging.

📁

Full Export

Export all your data anytime in JSON, CSV, or Parquet. No lock-in, ever.

Ready to see it in action?

Get started in under 5 minutes. Free during Alpha.

Get Started FreeRead the Docs