Architecture
Small core. Open edges.
Ayion Meru keeps a deliberately small core and puts everything else behind standard plug points: MCP for tools and agents, A2A for delegation, OpenTelemetry for telemetry, REST and events for the rest.
A stack in three bands. At the top, JhiOn for longevity and health span sits beside a dashed box for future vertical platforms in insurance, gaming and healthcare administration. Both feed into the middle band, Ayion Meru, which holds Run with its agents, packs and workspace beside Assure with its controls, evidence and reconciliation, and Core beneath the pair carrying identity, policy, the ledger, durable execution, the model gateway and capture. From Core, dashed lines drop to four plug points: models from any provider, agents whether Ayion’s, a partner’s or external, business systems reached through connectors and change feeds, and packs and controls for a department or an industry.
Core components
Six pieces, and nothing else.
Core decides who may act, what an action is, how it runs, which model serves it, what is recorded and how work arrives. Anything that is not one of those six is a plug point rather than a component.
| Component | What it does | What it guarantees |
|---|---|---|
| Identity and policy | Decides who and what may act, and under which limits. | Every action is attributed to an agent and to the principal it acts for before it runs. |
| Capability registry | Holds every action’s schema, permissions, side effects and cost. | Nothing runs that has not declared what it changes and what it costs. |
| Durable execution | Runs the work with retries, cancellation and duplicate protection. | A retried action does not become two actions in your system. |
| Model gateway | Routes to models by capability, cost and data location. | A model can be swapped, or kept inside a region, without touching the agents that use it. |
| Evidence ledger | Records each action, decision, approval, observation and reconciliation. | Append-only, hash-chained per tenant, sealed with your keys, and exportable without the platform. |
| Capture | Takes actions in from the MCP proxy, telemetry, connectors and change feeds. | An agent Ayion did not build is recorded the same way as one it did. |
A hub. The Meru Core sits in the middle as the smallest thing in the picture, labelled small on purpose, with six discs around it, each on its own spoke and joined to nothing else: models from any provider, agents whether Ayion’s, a partner’s or external, systems reached through connectors and change feeds, packs for a department or an industry, controls written as policy-as-code, and channels carrying approvals and exports.
Capture paths
Four ways an action reaches the ledger.
Assure has to record agents Ayion did not build, so capture has to be honest about what it can and cannot see. Each path states its own completeness, and a gap is declared rather than guessed.
What is live and what is planned| Path | How it captures | Completeness |
|---|---|---|
| MCP policy proxy | Sits inline on tool calls, evaluates policies per argument, and can be set to fail closed. | Complete for every call routed through the proxy. |
| Telemetry ingestion | Reads the OpenTelemetry GenAI conventions from your own collector. | Complete for instrumented agents, and silent wherever the instrumentation is missing. |
| Platform connectors | Reads agent platforms, support platforms and CRM through their own interfaces. | Bounded by what each platform exposes, and by which connectors are live rather than planned. |
| System-of-record change feeds | Read-only signed webhooks, replay-safe, carrying field-level differences. | Complete for the fields the feed carries; anything it cannot see is declared a gap. |
The evidence record
References and hashes. Not your data.
One record for each consequential action, in eight parts, hash-chained to the record before it. The ledger stores references, hashes and redacted parameters, never your business data.
Run cannot write to the ledger. Capture writes to it, the keys stay with you, and a third party can verify a record without anyone at Ayion.
One box at the top reads evidence record, one per consequential action. Eight boxes hang beneath it in two rows of four. Identity names the agent, the principal and the vendor. Action gives the type, the target and a hash of the parameters. Policy gives the blueprint version and the decision. Approval names the approver and the hash the approval was bound to. Execution gives the result, the retries and the cost. Observation gives the change seen in the system of record. Reconciliation gives the status and any corrections. Integrity, set apart from the other seven, holds the record hash and the chain hash that ties this record to the one before it. A note across the foot reads: the ledger holds references and hashes, never your business data.
Data handling and deployment
Managed today. Private later, and we say so.
Ayion Meru runs as a managed service with tenant isolation. The keys are yours, retention is set by class of record, and residency is chosen per tenant.
Trust and security-
Managed service, isolated per tenant.
One tenant’s policies, ledger and keys are separated from every other tenant’s. There is no shared ledger and no shared key.
-
Customer-held keys.
You hold the keys the evidence ledger is sealed with, so a record can be verified, or withheld, without us.
-
Retention by class.
Records, redacted parameters and exports each carry their own retention, set with you at provisioning rather than by one site-wide default.
-
Regional residency.
Residency is chosen per tenant. Which regions are open on the day you ask is a question we answer in writing before you connect anything.
-
Planned
Private deployment.
Running Ayion Meru inside your own cloud is on the roadmap and is not available at launch. It is said here rather than in a footnote.
Security posture
What we hold, and what we do not.
We hold no certification today. This section gets longer when something becomes true, and not before.
-
SSO and SCIM.
Single sign-on and directory-driven provisioning, so access follows your joiners, movers and leavers rather than a list of ours.
-
Audit of the auditor.
What anyone at Ayion can see inside your tenant is itself an action, recorded in the same ledger and visible to you.
-
A test before enforce mode.
Enforce mode is the point at which a control can stop an action. It does not ship until an external penetration test has been run against it.
-
Framework alignment, no certificate.
The control set and the evidence packs are built to map to SOX and ICFR, ISO/IEC 42001, the NIST AI RMF and the EU AI Act. Mapping to a framework is not certification against it, and we claim none. SOC 2 Type I is on the roadmap, without a published date until one is set.
Responsible disclosure.
Send anything you find to us before you send it anywhere else, and you will hear back from a person rather than an autoresponder.
security@ayion.aiBring the security questionnaire to the first call.
We would rather answer it in writing than in a meeting. A pilot starts once your questions are answered, and not before.