Almavar by 2Prod / Solution brief 02
Inside the customer boundary
Almavar installs inside your own boundary with one command. Your data, your permissions, your keys and your choice of model stay yours.
Deployment & secure execution · 6 min read · October 2026
Figures: Almavar operating data, 30 June to 21 October 2026.
The questions every security review asks
Before an AI agent touches production systems, a security team asks the same questions. Where does it run? What data leaves? Whose permissions does it use? Which AI models see the data? Who maintains it after go-live? Almavar answers each one by keeping the control with you.
It runs inside your own boundary, in the cloud account or environment you choose. Your team installs it with one command:
An Almavar install, run by the customer’s operator: prerequisites checked; infrastructure created in the customer’s environment; certificates and DNS; secrets generated and stored in the environment; database prepared; release pinned to exact versions; identity provider connected; integrations installed per license; health checks passed; a one-time owner set-up link issued. Then an upgrade: rolling, with no downtime, protecting work in progress. Commands: install, status, upgrade, rollback, remove.
The install checks prerequisites, creates the infrastructure in your environment, sets up certificates and secrets, and rolls out a release pinned to exact versions. It ends with a one-time link for your owner to sign in. On a closed network, the same install runs from your own mirror.
What stays inside, and what can leave
Everything Almavar keeps stays in that environment: conversations, memory, files and the full audit trail, in your database and storage, with secrets encrypted under your keys. None of it passes through 2Prod.
Almavar inside the customer’s own environment: the workspace, the policy gate, the customer’s database for conversations, memory and the audit trail, the customer’s storage, the customer’s keys, and model routing. Optional modules: web search, governed browser, file scanning, code sandbox. Only what the customer switches on leaves the account: AI model calls to the provider they choose, or none if self-hosted; web search queries; the governed browser. The customer’s systems are reached as each person with their own sign-in. No connection to 2Prod is needed: the license is checked offline and updates run only when the customer runs them.
Data leaves only through a switch you turn on. AI model calls go to the provider you choose, or nowhere if you run the model yourself. Web search and the governed browser each have their own switch. The license is checked offline, and the platform changes only when your operator upgrades it.
| What stays yours | What that means for you |
|---|---|
| Your data | Nothing to negotiate about vendor data handling, and nothing new for a vendor to lose. |
| Your permissions | No second permission model to build, audit or keep in sync. |
| Your keys | Secrets are encrypted under keys your security team holds. |
| Your model | Change models without re-approving the controls around them. |
| Your evidence | A tamper-evident audit trail you query directly. |
Your permissions, reused
Almavar uses the permissions your people already have. The first time someone asks for work in Jira or SharePoint, Almavar asks them to sign in to that system, and from then on its agents act through that person’s own access.
After the policy gate checks authority, each system is reached with the person’s own sign-in: Microsoft for Microsoft 365 and SharePoint, Atlassian for Jira and Confluence, ServiceNow, and Google for Google Workspace. Web apps with no API are reached through a governed browser the person can watch and take over. With no sign-in or a missing permission, the action stops and Almavar asks the person to sign in.
Your team doesn’t build or audit a second permission model, and when someone loses access in a source system, the agent loses it too. Almavar re-checks the person and their access before every action, so a suspension stops the next action, and a revoke at your identity provider takes effect within minutes.
100% of calls into business systems ran as the requesting person
0 fell back to a shared account when access was missing
Any model, the same rules
The sign-in decides what Almavar may touch, and the AI model has no say in it. You can change models without re-approving the controls around them, and run several side by side.
Models in use today: Claude Sonnet, Haiku and Opus on AWS Bedrock for reasoning; the GPT family from OpenAI; open models Qwen and Gemma self-hosted on the customer’s hardware; Amazon Nova 2 Sonic on Bedrock for voice. Azure OpenAI and Vertex AI are also supported. For every model the same things stay fixed: the person’s identity, granted capabilities, the policy gate, the approval and the audit record.
With a self-hosted model, AI calls never leave your network. Failover across providers follows the order you set, and budgets by workspace, team and person, plus a platform-wide stop, keep spending inside the limits you agree.
Day two: run it by asking
After go-live, your admins run Almavar the way your people use it, by asking. “Create a meeting-notes agent for the program team.” “Connect the Jira integration.” “Set this person’s monthly limit to $50.” Each admin request checks the admin’s role, anything high-risk waits for approval, and asking never grants more than the console would.
Upgrades follow the install. They roll out with no downtime, protect work in progress, refuse anything disruptive unless you allow it, and restore the previous release if something fails. The platform is engineered for regulated environments:
- FIPS 140-3 validated cryptography
- Secrets encrypted under your own keys
- Multi-factor sign-in, required under regulated profiles
- Malware scanning of every uploaded file
- Tenant isolation enforced in the database itself
- An audit trail that can’t be edited, with a tamper-evident export
Where these figures come from.
Figures come from Almavar’s operating deployment between 30 June and 21 October 2026, which 2Prod runs for its own company work.
Put a real workflow on the table.
Which systems matter, what should the agent do, who may approve it, and where must it run?