Get Started
Deployment options
LACE runs in four footprints. The governance substrate is the same in every one: permissions, evidence, budgets, approvals, and audit.
Footprints
| Footprint | Where it runs | Notes |
|---|---|---|
| Managed cloud | Our cloud (us-east-2, ECS Fargate + S3/CloudFront) | Fastest start; usage-based AI budgets with hard caps. Frontend on CloudFront, API on ECS. |
| Private cloud | Your VPC | SSO/OIDC, custom connectors, BYO models, your boundary. |
| On-premises | Your data center | Full platform, your hardware. Same Postgres/pgvector/NATS/Redis topology. |
| Air-gapped | Disconnected enclave | No external AI calls; all inference on open-weight models inside the boundary; updates from media you control. Accreditation evidence exportable. |
See infra/aws (Terraform), docker-compose.yml / docker-compose.prod.yml (service topology), and scripts/env/lace_env.py (the environment CLI behind every make env-* target) for the operational surface.
What changes, what does not
| Concern | Managed cloud | Private VPC / on-prem / air-gapped |
|---|---|---|
| Auth | Managed | Your IdP via OIDC/SSO (auth) |
| Connectors | All marketplace connectors | Same, plus network egress controls per footprint |
| Models | Hosted frontier under budget caps | BYO open-weight; hosted frontier where egress allows |
| Governance | Identical — scopes, ACLs, budgets, approvals, audit, per-call attribution (governance) | |
| App sidecars | Same LaceApp.yaml + lace_app_manifest.json contract everywhere | |
When air-gapped means air-gapped
Air-gapped is not a toggle on a cloud service. Model serving, embedding, indexing, and orchestration all run inside the boundary on open-weight models you host, so no code path needs an outbound connection. That includes model and platform updates, which come from media you control. Because enforcement lives outside the model, changing the model does not change what the platform will let it do.
Programs with an accreditation requirement should also read LACE-GOV, which packages the platform with BFO/CCO schema packs, cross-enclave federation, and exportable accreditation evidence.
Day-two operations
- Local dev:
make infra-up(postgres/minio/nats/redis) +make dev(api + workers, bind-mount + reload) +make dev-migrate(schema) — see clone & local dev anddocs/agentrunbooks. - Cloud:
make env-plan ENV=dev(always beforeenv-up) →make env-up / env-deploy→make env-status / env-logs / env-smoke→make env-hibernate / env-resume / env-down. Hot-push withmake dev-push-py/dev-push-fe(blocked in prod). - Observability:
make dev-observability(Tempo/Prometheus/Grafana) locally; OTEL collector in cloud (observability).
Next: architecture overview or install the SDK.