AgentBrain SOP

Appearance

SOP: On-Premise Deployment ​

Goal ​

Install a production-grade AgentBrain instance on customer-owned infrastructure (Kubernetes or bare metal), with encryption, RBAC, and audit log emission ready on day one.

Prerequisites ​

  • A licensed tier that includes on-premise deployment: Starter (GoClaw only), Business, Enterprise, or Custom
  • Kubernetes 1.27+ (recommended) or a Linux host with Docker
  • PostgreSQL 15+ for the control plane data store (managed or self-hosted)
  • pgvector extension enabled on the same PostgreSQL instance
  • Outbound network access to chosen LLM provider, or local model serving (for air-gapped)
  • An identity provider for SSO (Business tier and above)
  • A TLS certificate for the AgentBrain UI hostname

Steps ​

1. Plan deployment topology ​

Decide:

  • Cloud SaaS, On-premise, Hybrid, or Air-gapped (see Deployment Options)
  • Single-AZ or multi-AZ for high availability (Enterprise and above)
  • Customer-managed keys (BYOK) or AgentBrain-managed keys (Enterprise and above for BYOK)
  • LLM provider strategy: managed APIs, on-prem inference, or hybrid

2. Provision PostgreSQL ​

  • Create a database with the pgvector extension installed
  • Create a dedicated user with the privileges required for the AgentBrain schema
  • Capture connection string for the deploy step

Verification: SELECT extname FROM pg_extension WHERE extname = 'vector'; returns one row.

3. Configure secrets ​

Populate the secret store with:

  • Database connection string
  • Encryption master key (or KMS / HSM reference for BYOK)
  • LLM provider API keys
  • SSO certificate and metadata URL (Business tier and above)

4. Deploy GoClaw runtime ​

  • Install GoClaw via the supplied Helm chart (Kubernetes) or systemd unit (bare metal)
  • Pass the secrets reference
  • Wait for the runtime health check to pass

Verification: curl https://<your-host>/api/health returns {"status":"ok"}.

5. Deploy AgentBrain platform ​

  • Install the AgentBrain Helm chart pointing at the same secrets and database
  • Configure the public hostname and TLS certificate
  • Run the database migration job

Verification: open https://<your-host> and the AgentBrain UI renders the login screen.

6. Configure SSO (Business tier and above) ​

Follow SSO setup. At a minimum:

  • Register AgentBrain as a service provider in your IdP
  • Upload the IdP metadata to AgentBrain
  • Test login with a non-admin account

7. Configure RBAC (Business tier and above) ​

Follow the RBAC Setup SOP.

8. Connect knowledge sources (Business tier and above) ​

Follow the Knowledge Vault Setup SOP.

9. Configure channels ​

Follow the Channel Deployment SOP for each channel you plan to use.

10. Validate audit logging ​

  • Perform a test action (invoke an agent, read a knowledge doc, grant a role)
  • Confirm the action appears in the audit log within seconds
  • Confirm the audit log export to SIEM is functioning if configured

Verification: audit log query returns the expected entries.

Rollback ​

  • Stop the AgentBrain and GoClaw services
  • Drop the database (or restore from snapshot) if you need to start over
  • Revoke any IdP service-provider registration