Envoy routing
Strict timeouts, connection limits, health checks and last-known-good configuration.
Fast data plane
Global entry. Local decisions. Parallel analysis.
Cloudflare for SaaS supplies global ingress and volumetric protection. Envoy and Coraza apply service-specific controls without a central database or AI call in the request path.
What the current evidence supports
Ordinary allowed traffic stays on the shortest path. Deep correlation, threat matching and reporting start after the request decision.
GoTe now
GoTe nowGoTePrivate beta · operator-assisted
- Traffic
- Checking current route
- Protection
- Unknown
- Runtime
- Unknown
- Scope
- Not verifiable
- Traffic proof until
- Not verifiable
Current state is shown only after a fresh, schema-validated snapshot is loaded.
Open status evidencePlatform capabilities
These cards describe product scope. Current delivery stage, runtime health, scope and freshness are reported separately from the validated public snapshot above.
Platform · implemented
Coraza inspection
OWASP CRS runs out of process over a private Unix socket and remains shadow-first.
Asynchronous intelligence
Bounded metadata enters the case and threat pipelines without delaying the visitor.
02
How you use it in an operating workflow
The visitor path remains short. Configuration, verification and rollback stay visible to the operator at every stage.
Fast request pathParallel analysisEvidence before promotion
- 01
Cache first
Cloudflare serves eligible static assets before they reach AegiFlow.
- 02
Inspect locally
Envoy and Coraza make bounded request decisions on the edge host.
- 03
Analyze later
The control plane correlates events and proposes reversible action.
The interface explains what is known, unknown and required
AegiFlow does not turn missing evidence into a reassuring zero. Every state links to its source, freshness and next action.
- Delivery stage
- Planned, implemented, verified, activatable or active.
- Runtime health
- Healthy, degraded, stale, unknown or unavailable — independently of delivery stage.
- Evidence
- Source, timestamp, scope and last successful verification.
- Action
- The responsible party, exact change and expected impact.
- Way back
- Rollback instructions are defined before an active change.
In depth
How this capability behaves in production — grounded in the platform's documented, current operation.
Inspection out of process, measured in single-digit milliseconds
The AegiFlow edge pairs Envoy routing with OWASP CRS inspection running out of process, over a private local socket that only the two components can reach. In warmed benchmark runs, the added inspection overhead measured a p95 between 3.0 and 3.4 milliseconds — and inspection stays shadow-first until enforcement gates pass.
Failure means falling open, never falling on the visitor
Strict timeouts and last-known-good configuration bound the effect of an inspection-component failure; the shadow path is configured to fail open. Databases, threat feeds and dashboards are not synchronous dependencies of the visitor request.
Start without changing traffic. Activate only measured controls.
Ownership, certificate, origin health and rollback must pass before traffic protection changes.