Demo showcasing a complete enterprise-grade platform for deploying, securing, and observing AI agents on Red Hat OpenShift AI 3.x.
This project demonstrates the BYOA (Bring Your Own Agent) approach from the Red Hat AI Agentic Strategy 2026: customers choose any agent framework, Red Hat provides the production-ready infrastructure underneath.
Key message: Your Agent. Our Platform. Production-Ready.
Interactive map: v5/live.html step Overall Demo (./scripts/demo-presenter-serve.sh). Standalone reference: overall-demo-architecture.html. Static PNG above: regenerate locally with make export-architecture after diagram edits.
┌─────────────────────────────────────────────────────────────┐
│ USER LAYER │
│ End user → Control UI (openclaw-ui-proxy, nginx mTLS bridge)│
├─────────────────────────────────────────────────────────────┤
│ AGENT LAYER (BYOA — demo harness: OpenClaw) │
│ OpenClaw in Agent Sandbox (OpenShell policies: Landlock) │
├─────────────────────────────────────────────────────────────┤
│ PLATFORM LAYER (Red Hat) │
│ OpenShell Gateway (egress choke point, key injection) │
│ MLflow — tracing + prompt registry (background spans) │
│ NeMo Guardrails via TrustyAI (enabled live in Change 2) │
├─────────────────────────────────────────────────────────────┤
│ INFERENCE LAYER │
│ inference.local → [NeMo] → MaaS → LLM (external MaaS) │
├─────────────────────────────────────────────────────────────┤
│ INFRASTRUCTURE │
│ OpenShift + RHOAI 3.x · Agent Sandbox Operator (OLM) │
└─────────────────────────────────────────────────────────────┘
The agent harness is interchangeable (BYOA); the platform stack works regardless of framework. Interactive architecture map (live): v5/live.html step Overall Demo. Deep dive: Agent Sandbox and OpenShell — How It Works.
Start here if you want to understand how agent isolation actually works in this demo: Agent Sandbox and OpenShell — How It Works.
That guide walks through the full stack — Agent Sandbox Operator, OpenShell gateway, sandbox policies (Landlock, network namespaces), and how OpenClaw runs inside an isolated sandbox rather than as a plain Kubernetes Deployment. It complements the install guides (cluster-bootstrap.md, openshell-installation.md) with architecture and the launch-openclaw.sh procedure.
All operators and components use explicit pinned versions. We upgrade deliberately and test before bumping to avoid surprises from upstream releases. See AGENTS.md for the full version pinning policy.
- Security: NeMo Guardrails block prompt injection, topic deviation, and data exfiltration
- Isolation: OpenShell sandboxes agent execution with zero-trust principles
- Observability: MLflow captures full agent execution traces via the mlflow-openclaw plugin
- Prompt Management: Versioned prompts in MLflow Prompt Registry enable A/B testing
- Platform Agnostic: The agent framework is interchangeable - the platform works regardless
# Full demo (from repo root)
make demo
# Platform only
make deploy-all && make validate| Step | Guide |
|---|---|
| Bootstrap RHOAI platform on OpenShift | docs/cluster-bootstrap.md |
| Install OpenShell (local or cluster) | docs/openshell-installation.md |
| Agent Sandbox + OpenShell architecture (OpenClaw in sandbox) | docs/AGENT-SANDBOX-AND-OPENSHELL.md |
| Browser UI (nginx mTLS bridge + password) | make deploy-agent or make demo — see ADR-0011 |
├── Makefile # Wrapper → deploy/Makefile (make demo, deploy-all, …)
├── AGENTS.md # AI agent context (for Cursor/Claude)
├── README.md # This file
├── assets/ # README diagrams (overall-architecture.png — see make export-architecture)
├── config/ # OpenClaw template + OpenShell sandbox policies
├── docs/ # Guides, ADRs, demo narrative, ROADMAP
├── deploy/ # Helm charts + deploy/Makefile
│ └── helm/ # operators, platform, mlflow, guardrails, openshell, …
├── agent/workspace/ # OpenClaw workspace identity files
├── tests/ # Playwright E2E + health-check.sh
├── scripts/ # cluster-lifecycle, demo-*, launch-openclaw, …
└── secrets/ # secrets.env (gitignored)
- NeMo Guardrails Installation
- Demo script (live, ~9–10 min) — Cursor skills in AGENTS.md § Demo v1
- Demo scenario logs runbook — per-test log evidence and Sandbox panel highlight rules
- Demo narrative v1 (Spanish)
- Demo presenter UI —
v5/live.htmllive companion + observability panel - docs/ROADMAP.md - Development roadmap and task tracking
- docs/cluster-bootstrap.md - RHOAI platform deploy, validate, and teardown on OpenShift
- docs/openshell-installation.md - OpenShell install (local macOS/Linux + OpenShift Helm chart)
- docs/AGENT-SANDBOX-AND-OPENSHELL.md - Agent Sandbox, OpenShell, and OpenClaw launch architecture
- docs/stack-decisions.md - Architecture decisions executive summary
- docs/adr/ - Full Architecture Decision Records
- docs/github-actions.md - GitHub Actions CI (PR unit tests + Helm lint)
- Platform: Red Hat OpenShift AI (RHOAI) 3.x
- Cluster: demo.redhat.com / RHPDS
- Inference: External MaaS endpoint
- Version Policy: All operators pinned to explicit versions (no automatic updates)
This is a collaborative project. See AGENTS.md for the full context on architecture decisions and constraints.
Apache-2.0