ASTRA BASTION Documentation
Everything you need to secure, govern, and monitor AI systems across your enterprise. From initial setup to advanced agent orchestration.
Quick Start
Get ASTRA BASTION protecting your AI workloads in under 10 minutes.
Sign Up & Configure Tenant
Create your organization account, invite team members, and configure RBAC roles. Each tenant gets full data isolation via PostgreSQL Row-Level Security.
Connect Your AI Gateway
Point your LLM API calls through ASTRA's Gateway. Supports OpenAI, Anthropic, Google, Azure, AWS Bedrock, and 13+ more providers out of the box.
Monitor Your Trust Score
Your organization's Trust Score computes automatically across 5 pillars. Set thresholds, configure alerts, and track improvement over time.
Architecture Overview
Modular Monolith, Built for Scale
ASTRA BASTION is architected as a modular monolith with 12 bounded contexts following Domain-Driven Design. Each module enforces strict boundaries through hexagonal architecture (ports and adapters), enabling independent evolution while sharing infrastructure.
- Hexagonal Architecture -- Domain logic has zero framework dependencies
- CQRS -- Selective command/query separation for high-throughput modules
- Event-Driven -- CloudEvents v1.0 on Redis Streams with consumer groups
- Result Monad -- Result[T, DomainError] pattern throughout -- no thrown exceptions
Platform Modules
Each module is a fully self-contained bounded context with its own database schema, domain events, API surface, and test suite.
Key Concepts
Multi-Tenancy (RLS)
Every table includes a tenant_id column with PostgreSQL Row-Level Security policies. Data isolation is enforced at the database level -- not the application level -- making cross-tenant data leakage architecturally impossible. Middleware sets SET LOCAL app.current_tenant_id on every request.
Event-Driven Architecture
Modules communicate asynchronously via 137 domain events published to Redis Streams using the CloudEvents v1.0 envelope format. Consumer groups with XAUTOCLAIM ensure at-least-once delivery. A transactional outbox pattern guarantees events are published only when the originating database transaction commits.
CQRS Pattern
High-throughput modules (AI Gateway, Trust Engine, CyberTwins) use selective Command/Query Responsibility Segregation. Write operations go through command handlers with domain validation; read operations use optimized query handlers that can bypass the domain layer for performance. Other modules use standard CRUD where CQRS overhead is unnecessary.
Trust Score (5 Pillars)
Your organization's Trust Score is computed from 5 weighted pillars: Security (25%), Compliance (25%), Risk (20%), Resilience (15%), and AI Governance (15%). Each pillar pulls real-time data from its respective module via Anti-Corruption Layer adapters. Scores decay over time using configurable models (linear, exponential, step, sigmoid) and recalculate on domain events with 30-second debounce.
SDKs & Libraries
Python SDK
Full-featured SDK with async support, type hints, and auto-retry. Built on httpx with Pydantic models.
"text-purple-400">pip install astra-bastionTypeScript SDK
Fully typed SDK for Node.js and edge runtimes. Tree-shakeable with zero dependencies.
"text-purple-400">npm install @astra-bastion/sdkREST API
~239 endpoints with OpenAPI 3.1 specs. JSON envelope responses, cursor pagination, RFC 7807 errors.
"text-purple-400">curl https://api.astrabastion.com/api/v1/healthReady to Secure Your AI?
Get started with a guided demo and see how ASTRA BASTION protects your AI workloads from prompt injection, data leakage, and compliance violations.
Request a Demo