TramAI - governed AI workflows for Java and Kotlin

Enterprise AI Governance for JVM Systems

Enterprise AI integration is not just about calling a model API. The hard part is making the resulting system governable.

That means knowing who approved what, which provider was used, what policy was applied, what the model returned, and how the workflow behaved when something failed or crossed a trust boundary.

What Governance Actually Requires

  • policy-aware execution
  • approval gates for sensitive actions
  • auditable workflow behavior
  • observability at the operation and system level
  • clear deployment and provider control

TramAI’s Angle

TramAI is useful when you want AI integrated into a JVM application without treating governance as a separate, later-stage bolt-on.

These controls ship in 0.6.0 and live inside the runtime, not beside it:

  • approval workflows — high-risk tool calls suspend execution and resume only on a token bound to the exact call; the approval, suspended invocation, and continuation records are durable, so a restart does not lose the request
  • policy-aware tool execution — deny-by-default PolicyConfiguration.secure() plus explicit model, provider, fallback, tool, and permission allowlists, enforced at tool exposure, execution, and result reinjection
  • security and sovereignty modes — tramai.profile: standard or sovereign, where the sovereign profile rejects wildcard allowlists and providers without an explicit trust zone at startup
  • audit and evidence material — a SHA-256 hash-chained audit stream, policy.decision / tool.permission / approval.decision runtime evidence, evidence packs describing deployment posture, and local model artifact verification with digest receipts
  • observability and operational diagnostics — native OpenTelemetry spans and metrics, plus sovereign ops modules for Actuator health, Micrometer metrics, and worker status

What 0.6.0 does not ship: a cross-deployment control plane for viewing and intervening in workflows, policies, approvals, and evidence across a fleet (0.7.0 direction), automated mapping of evidence to regulatory obligations, and certification tooling. 0.6.0 is a published release candidate with a documented stability boundary — see API stability.

Good Fit Scenarios

  • internal enterprise platforms adopting AI under review
  • corporations with architecture, compliance, or security oversight
  • teams that need traceability around model-backed decisions
  • regulated environments where provider choice and trust boundaries matter

Why Generic AI Frameworks Often Fall Short

Many frameworks optimize for speed of experimentation, not controllability. That is acceptable early on, but weak once AI operations begin touching customer data, internal tools, or business processes that require oversight.

TramAI is aimed at the stage where the question becomes:

How do we integrate AI into the enterprise without losing control of the system?

Governance Pillars

This page is the enterprise-fit view. The technical depth lives in the governance cluster:

Continue

Previous
Next