Signed policy moves down.
- Administrator publishes tenant policy
- Control plane compiles and signs an immutable publication
- Endpoint verifies tenant, signer, sequence, and trusted time
- Last-known-good policy activates atomically
SYSTEM ARCHITECTURE
Policy lives at the enforcement boundary.
ReDLP separates content inspection, policy distribution, and security visibility into explicit paths—with the endpoint as the control point.
CONTENT PATH
The decision happens before the request leaves the device.
A supported adapter captures send intent, the ReDLP Native Broker hands it to the ReDLP Service, and the local policy engine determines the outcome.
01AI web applicationUser intent
02ReDLP Browser ExtensionApplication adapter
03ReDLP Native BrokerBound local IPC
04ReDLP ServiceLocal policy authority
05Allow · Warn · Block · Redact · ReplaceMutually exclusive result
SENSITIVE CONTENT REMAINS INSIDE THE ENDPOINT TRUST BOUNDARY
Content-free evidence moves up.
- Endpoint creates a closed-schema event
- Device authenticates and signs the request
- Control plane enforces tenant and route boundaries
- Portal presents operational metadata only
TRUST MODEL
Every boundary has a specific job.
Content authority
Inspects, decides, transforms, queues metadata, and preserves last-known-good policy.
Policy authority
Authenticates tenants and devices, signs publications, and stores closed-schema metadata.
Administrative authority
Publishes policy, manages device lifecycle, and exposes content-free security evidence.
ARCHITECTURE REVIEW
Trace your AI data path with us.
Bring your browsers, identity model, device estate, AI applications, and enforcement requirements.