Deployment Overview - TealTiger Docs

TealTiger provides flexible deployment options. The SDK runs inside your application boundary with zero external dependencies. For platform-native integration, use the v1.3 adapters.

Deployment Models

Model	Latency	Complexity	Best For
Embedded SDK	< 25ms	Low	Most applications (recommended)
Platform Adapter	< 30ms	Low	AWS Bedrock Agents, AgentCore, Azure AI Agent Service
Docker Sidecar	< 35ms	Medium	Language-agnostic, polyglot teams
Kubernetes	< 35ms	Medium-High	Enterprise scale, multi-team

Embedded SDK (Recommended)

Governance runs inside your application process. No network calls for evaluation.

npm install tealtiger    # TypeScript
pip install tealtiger    # Python

import { TealEngine } from 'tealtiger';
const engine = new TealEngine({ bundle: await loadBundle('./governance/bundle.signed.json') });
const decision = await engine.evaluate(request, ctx);

Advantages: Lowest latency, no network dependency, simplest deployment.

Platform Adapters (v1.3)

Native integration with cloud agent platforms:

AWS Bedrock Agents

Lambda Layer or sidecar for Bedrock Agent action groups

AWS AgentCore

Lifecycle governance hooks (onCreate, onExecute, onTool, onTerminate)

Azure AI Agent Service

Azure Function or AKS sidecar for tool-call pipeline

Infrastructure Options

Serverless

AWS Lambda, Cloud Run, Azure Functions. Event-driven, auto-scaling.

Docker

Governance sidecar container. Language-agnostic HTTP API.

Kubernetes

Helm chart, sidecar injection, enterprise scale.

PaaS

Heroku, Render, Railway, Fly.io. Rapid deployment.

Infrastructure as Code

Terraform

Official Terraform modules

Pulumi

Infrastructure in TypeScript/Python

Helm

Kubernetes Helm charts

Governance Bundle Distribution

In enterprise deployments, governance teams publish signed policy bundles that applications load at startup:

Distribution Method	Use Case
S3 / GCS / Azure Blob	Cloud-native, IAM-controlled access
OCI Registry	Container-native, versioned artifacts
npm / PyPI private registry	Developer-familiar tooling
Git repository	Version-controlled, PR-based changes

// Load signed bundle from S3
const engine = new TealEngine({
  bundle: { source: 's3://acme-governance/production/latest.signed.json' },
  bundle_verification: { public_key: process.env.GOVERNANCE_PUBLIC_KEY, require_signature: true },
});

See Governance at Scale for the full enterprise operating model.

Workload Identity Binding (v1.3)

Bind governance bundles to specific platform workload identities:

Platform	Identity Source
Kubernetes	ServiceAccount
AWS ECS/Lambda	IAM Role
Azure ACI/Functions	Managed Identity
GCP Cloud Run	Service Account

This ensures bundles only work in authorized environments.

Operations

Monitoring

Prometheus metrics, OTel spans, CloudWatch/App Insights

CI/CD

Policy testing in pipelines, automated bundle signing

Security

Network isolation, secret management, encryption

Cost Optimization

Right-sizing, caching, module selection

Next Steps

Quickstart

Get governance running in 5 minutes

Platform Adapters

Native cloud platform integration

​Deployment Models

​Embedded SDK (Recommended)

​Platform Adapters (v1.3)