The enforcement point AI egress cannot route around

Software guardrails are advisory. Auditors want proof.

An in-process SDK or a prompt wrapper is something your developers can disable, forget, or route around — and when an incident happens, you have no cryptographic record that the control ever executed. Regulated buyers need an enforcement point that sits in the network path, fails closed, and produces evidence.

Every egress request transits governance before it leaves the pod

Your application routes outbound HTTP(S) through the sidecar by setting HTTPS_PROXY to the sidecar on port 3128. The sidecar relays each request to EVE’s hosted governance API. On a pass, it forwards upstream and streams the response back. On a violation, it returns 451, severs the TCP connection, and emits a signed Decision Certificate. No upstream request is ever issued on a veto.

A non-bypassable gateway that produces evidence

One container in the pod, one init container for non-bypass

The sidecar runs alongside your application container. An optional NET_ADMIN init container installs iptables rules that redirect egress to the sidecar, so enforcement holds even if the app never sets a proxy variable.

# Sidecar container — same pod as the app
containers:
  - name: app
    env:
      - name: HTTPS_PROXY
        value: "http://127.0.0.1:3128"
  - name: eve-sidecar
    image: eveaicore/sidecar:latest
    ports: [{ containerPort: 3128 }]
    env:
      - name: EVE_PROXY_ORG_ID      # tenant stamped into every cert
        valueFrom: { fieldRef: { fieldPath: metadata.labels['tenant'] } }
      - name: JWT_SECRET_KEY         # HMAC signing key (from a Secret)
        valueFrom: { secretKeyRef: { name: eve-signing-key, key: hmac } }
      - name: EVE_PROXY_FAIL_CLOSED
        value: "1"
    readinessProbe: { httpGet: { path: /readyz, port: 3128 } }
    livenessProbe:  { httpGet: { path: /healthz, port: 3128 } }

# Init container — non-bypass egress redirect
initContainers:
  - name: egress-redirect
    securityContext: { capabilities: { add: ["NET_ADMIN"] } }
    args: ["iptables -t nat -A OUTPUT -p tcp ! -o lo --dport 443 -j REDIRECT --to-port 3128"]

Prefer a library? Use the fail-closed wrapper

Teams that don’t want the proxy posture can consume EVE as a library with the same guarantees. The @enforce decorator bounds execution by a timeout, converts any exception or overrun into a fail-closed veto, and returns a signed HMAC-SHA256 certificate for every outcome.

from core.governance.fail_closed import enforce, FailClosedError

@enforce(caller="my_service.call_llm", org_id="bank_tier1_a", timeout_s=2.0, run_fmi=True)
def call_llm(prompt: str) -> dict:
    return llm_client.generate(prompt)

try:
    result = call_llm(user_prompt)
    cert = result["certificate"]        # signed allow cert
except FailClosedError as e:
    cert = e.certificate.to_dict()      # signed block or fail_closed cert

Hosted SaaS. Signed image. Nothing proprietary on-prem.

EVE is operated exclusively as a hosted service by EVE NeuroSystems LLC. What runs in your environment is a thin, stateless network relay — not the governance engine.

What ships today, and what is coming

We are explicit about the current edges. HTTPS CONNECT tunnels are passed through today (the target host is still subject to veto, but plaintext body inspection requires TLS termination, which is on the roadmap).