# Deployment Variants

Universal governance across Kubernetes, Serverless, and Managed Agent Platforms.

Source: https://mandrel-web-363efb.gitlab.io/docs/guides/deployment-variants/

---


The Mandrel Project is designed as a **Universal Governance Overlay**. While Kubernetes with the Gantry Operator is the reference "Gold Standard" for assurance, Mandrel's enforcement logic is portable across any compute environment or agentic framework.

## Architectural Patterns

Mandrel adapts its "Clamping" mechanism to match the native capabilities of the target platform.

### 1. The Sidecar (Kubernetes & Serverless)
The reference pattern where the [Collet](https://mandrel-web-363efb.gitlab.io/docs/reference/collet.md) sidecar and the Agent share a network namespace.

*   **Standard K8s**: Automated injection via the Gantry Operator with transparent `iptables` redirection.
*   **GCP Cloud Run / AWS Fargate**: Multi-container service definitions where the Collet acts as the primary ingress proxy.

### 2. The Custom Extension (Managed Platforms)
For opaque, fully managed agent ecosystems where sidecars are not permitted.

*   **Vertex AI Agent Engine**: Mandrel is registered as a **Custom Tool**. The engine invokes the Mandrel endpoint to certify user intent and budget before allowing the agent to proceed.
*   **Amazon Bedrock Agents**: Integrated via a **Lambda Layer** that wraps the agent's action groups, performing in-process interception of the Bedrock session context.

### 3. The Logic Hook (Framework-First)
For developers building code-first agents using high-level orchestration libraries.

*   **LangGraph**: Mandrel acts as a **State Reducer** node that validates transitions. It utilizes native LangGraph **Interrupts** to handle governance "Challenges" (HITL).
*   **AutoGen / CrewAI**: Integrated as a **Proxy Agent** or "Speaker Middleware" that enforces the spec's `permitted-delegates` list before allowing agent-to-agent delegation.

### 4. Private Plumbing (Edge & Legacy)
For environments where automated mesh management is unavailable.

*   **Podman / Docker Compose**: Uses private virtual networks to ensure the Agent is unreachable except through the Collet's governed port.
*   **Bare Metal**: Uses **Static Port Offsetting** and local firewalls to bind the Agent to `localhost` and the Collet to the public interface.

---

## Capability Matrix

| Feature | K8s / Gantry | Cloud Run / Fargate | Bedrock / Vertex | LangGraph / AutoGen |
| :--- | :--- | :--- | :--- | :--- |
| **Identity** | SPIFFE / SVID | Workload Identity | Platform Session | Application Auth |
| **Trust domain** | Platform policy, resolved at promotion | Platform policy | Platform policy | Platform policy |
| **Promotion authority** | Managed Lab, self-hosted lab, or CI | Any | Any | Any |
| **Enforcement** | L3/L4 + L7 | Layer 7 Proxy | Pre-flight Tool | Logic-flow Hook |
| **HITL Pattern** | Step-Up Token | Step-Up Token | Platform Interrupt | Native `interrupt()` |
| **Egress Control** | Transparent Envoy | Forward Proxy | VPC Perimeter | Code-level |

## Environment-Specific Guides

*   **[Mandrel CLI Reference](https://mandrel-web-363efb.gitlab.io/docs/reference/cli.md)**: See the `generate` command for platform-specific manifest targets.
*   **[Metrology Lab](https://mandrel-web-363efb.gitlab.io/docs/reference/metrology-lab.md)**: Learn how the Lab bakes environment-specific platform policies into your Realized Spec.
*   **[Kong Gateway & Mesh Integration](https://mandrel-web-363efb.gitlab.io/docs/guides/kong-integration.md)**: Compile specs into declarative Kong Gateway plugins and Mesh traffic permissions.

## Bring your own promotion authority

Every variant above assumes something produces signed Realized Specs. That something does not
have to be the managed Metrology Lab, and it does not have to be a service at all: verification
is offline by construction, so a pipeline that bakes, signs and writes a file satisfies the
mandatory profile. The [metrology contract](https://mandrel-web-363efb.gitlab.io/docs/spec/metrology-contract.md)
defines what conformance requires, and is honest about the one thing a CI-only authority cannot
provide — agent-name uniqueness.