> ## Documentation Index > Fetch the complete documentation index at: https://docs.hexr.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hexr Documentation > Audit-grade evidence for AI agents — in your cluster. Per-process SPIFFE identity, OPA policy enforcement, and signed evidence rows in your own Postgres. ## What Hexr is Hexr is what you get if Iru, CrowdStrike, and Datadog had a child specifically for AI agents. * **Like Iru** — every agent action maps to a named control: SOC 2 CC6.1, HIPAA §164.312, NIST SSDF PW\.4, FedRAMP AU-2. * **Like CrowdStrike** — a privileged DaemonSet with `hostPID` gives every subprocess its own SPIFFE identity, cryptographically attested at the node level. Not per pod. Per process. * **Like Datadog** — full OpenTelemetry spans emitted automatically by `hexr_llm()`, consumed by whatever observability stack you already run. Your FFIEC, SOC 2, HIPAA, or FedRAMP auditor will ask what your AI agents did, who authorized it, and where the evidence lives. Hexr puts signed, control-mapped evidence rows into your own Postgres — per process, per agent call, any framework. Nothing leaves your VPC. *** ## From decorator to production in three commands Use any Python framework — CrewAI, LangChain, OpenAI, or raw Python. Add one decorator. ```python theme={null} from hexr import hexr_agent, hexr_tool, hexr_llm @hexr_agent(name="research-analyst", tenant="acme-corp") def analyze(topic: str): s3 = hexr_tool("aws_s3") # authenticated — no keys in code client = hexr_llm(openai.OpenAI()) # auto-traced with cost attribution return client.chat.completions.create( model="gpt-4o", messages=[{"role": "user", "content": f"Analyze {topic}"}] ).choices[0].message.content ``` The CLI scans your source code via AST, discovers every `@hexr_agent`, `hexr_tool()`, and `hexr_llm()` call, then generates a Dockerfile, Kubernetes manifests, and injects four sidecar containers automatically. ```bash theme={null} hexr build # AST discovery → Dockerfile + manifests + sidecar injection hexr push # Container image → registry ``` One command schedules your agent as a Kubernetes Pod. The Auto-Registrar creates a SPIFFE identity. The Credential Injector provisions cloud access. Envoy starts mTLS. Observability flows. ```bash theme={null} hexr deploy # Kubernetes scheduling → SPIFFE registration → ready ``` ## What every deployed agent gets — automatically Every subprocess your agent spawns gets its own X.509 SVID — cryptographically attested by a `hostPID` DaemonSet on the node. Not per pod. Per process. Same mechanism as CrowdStrike Falcon, built for AI agents. Every agent action hits OPA before it executes. Rego policies at every service boundary. Fail-closed. Allow or deny logged with the SPIFFE ID of the caller, the policy version, and the mapped compliance control. Every action writes a signed row to your Postgres — tagged with the SPIFFE ID, timestamp, policy result, and the compliance control it maps to. Your database. Your VPC. Nothing sent to Hexr. `hexr audit` generates a signed PDF from your evidence rows. SOC 2, HIPAA §164.312, NIST 800-53, FedRAMP AU-2, EU AI Act. Every agent action, every control it maps to. `hexr_tool("aws_s3")` returns an authenticated boto3 client. JWT-SVID → AWS STS / GCP WIF / Azure exchange. No long-lived credentials. No rotation. A2A sidecar with JSON-RPC 2.0. Both sides validate SPIFFE SVIDs via federated trust bundle. The full delegation chain appears as a single evidence row. *** ## Deployment Hexr runs on your Kubernetes cluster — EKS, GKE Standard, AKS, or on-premises. You own the cluster, the Postgres, and every evidence row. The Hexr Control Plane handles licensing and cluster registration; it never sees your agent evidence or credentials. Hexr CP acts as SPIRE UpstreamAuthority. Fastest path to production. Suits teams without an existing PKI. Connected deployment. Your HashiCorp Vault PKI is the intermediate CA. Hexr CP is the upstream authority. Required for HIPAA BAA scope, FedRAMP IL5, or any deployment where your security team controls the root. Zero outbound connectivity. All images pre-loaded. No `api.hexr.cloud` egress required. Required for FedRAMP IL5, ITAR, CMMC L3 — or any environment where the security team must approve every network path. *** ## Framework Agnostic Write agents with any Python framework. Hexr detects and adapts automatically. Multi-agent crews with role-based agents. Chains, agents, and tools with LangGraph orchestration. Multi-agent conversation patterns. AWS-native agent framework with tool decorators. Google Agent Development Kit. No framework needed. Just `@hexr_agent` and go. *** ## Who Hexr is for | Buyer | Compliance Pain | Hexr Answer | | ---------------------------------------- | -------------------------------------------- | ------------------------------------------------------------------------------------------------ | | Multi-cloud finserv (hedge funds, banks) | FFIEC, SEC, FINRA — per-process attestation | Per-process SPIFFE + signed evidence rows in customer Postgres | | Regulated healthcare | HIPAA §164.312 — PHI access audit trail | BYO Vault PKI (Mode B), evidence stays in customer VPC, zero Microsoft/AWS/GCP cloud involvement | | Defense / govtech | FedRAMP IL5, ITAR, CMMC L3 — no SaaS vendors | Air-gapped Helm chart, no internet egress, customer-owned trust root | | AmLaw 100 + Big-4 audit firms | Client data cannot leave jurisdiction | Cross-cluster A2A mTLS, federated SPIFFE, full delegation chain in evidence | *** ## Next Steps Helm + Terraform quickstart for EKS, GKE, or AKS. Running in under an hour. How identity flows: SPIRE → SVID → OPA → evidence row → auditor PDF. SPIFFE identity model, OPA policies, FFIEC/HIPAA/FedRAMP control mapping. 15-minute walkthrough: OPA deny, evidence row, signed PDF. Live cluster.