HAVAA is an agentic AI platform that supplies the parts every serious agent deployment needs — a visual builder, a multi-tenant runtime, a knowledge base, tools, four graduated safety modes and a full audit trail — as one deployable artefact. It runs as SaaS, as Docker Compose on a single server, or on Kubernetes, with the same code path in all three.
The problem it addresses is not making an agent answer well. That takes an afternoon. It is getting one into production inside a bank, a ministry or a hospital.
What does HAVAA actually provide?
Six capabilities, and the reason they are worth having as a platform rather than as project code is that each is otherwise rebuilt per project, at whatever quality that project's deadline permitted.
A visual agent builder with structured identity, tone, tasks and instructions, and a playground that shows the exact system prompt before deployment. The value is that the agent's configuration is inspectable rather than buried in application code.
Four safety modes — Chatbot, Assistant, Worker and Autonomous — with capability granted per mode and human-in-the-loop approvals on the actions that need them.
A full audit trail recording every action, input and approval, exportable, with PII redaction and prompt-injection detection applied in the path rather than bolted on.
Multi-tenant isolation enforced by PostgreSQL Row-Level Security, at the database rather than in application code.
A RAG knowledge base with document ingestion, vector search and source citations, configured per agent so expertise stays scoped.
Autonomous missions for background work, running a Plan → Execute → Checkpoint → Evaluate loop for scheduled and event-triggered tasks.
Why does this need to be a platform rather than a framework?
Because the components that fail a compliance review are not the ones frameworks provide.
Getting a model to answer well is genuinely straightforward now. What is not straightforward is answering the questions a regulated institution asks before go-live: what did it do, on whose behalf, who approved it, what data could it reach, and what happens when it is wrong. Those answers come from identity propagation, policy gates, an audit trail and tenant isolation — the components examined in AI orchestration architecture.
Built per project, they diverge. Three teams implement approvals three ways and one of them is the one that ships without a gate. Rate limits, kill switches, redaction and injection defence get re-implemented at three different quality levels. Multi-tenant isolation enforced in application code is one missing filter away from a cross-tenant disclosure.
The consequence is the pattern most organisations recognise: pilots stay pilots, the institution accumulates half-finished agent projects each carrying its own bespoke risk surface, and none of them survives a compliance review.
What do the four safety modes do?
The design decision that most affects whether an agent reaches production, because it replaces a binary with a ladder.
The usual failure is that agents ship either fully manual — in which case nobody uses them, because the human still does all the work — or fully autonomous, which nobody will sign off on. Neither extreme is deployable in a supervised institution.
The four modes grant capability progressively. Chatbot answers from its knowledge base. Assistant works alongside a person, proposing rather than acting. Worker completes defined tasks with approvals on the actions that need them. Autonomous runs missions in the background within its granted capability.
Two things follow from this that matter operationally.
A deployment can advance through the modes as evidence accumulates. Start in a mode where errors are recoverable, measure, then grant more capability when the acceptance rate justifies it. This maps directly onto the shadow-to-assistive-to-supervised rollout described in how AI agents automate business processes.
Capability is a platform-enforced property, not a prompt instruction. An agent in Assistant mode cannot take a Worker action because the runtime does not permit it — not because the system prompt asked it not to. Given that the model is not a security control, this distinction is the difference between a stated policy and an enforced one.
What is in the audit trail?
Every action, input and approval, recorded and exportable, with PII redaction and prompt-injection detection applied in the request path.
Two design choices are worth drawing out.
Redaction and injection detection sit in the path, not alongside it. A detector that runs as an offline job finds problems after they have been acted on. In the path, it can prevent the action.
The trail is exportable. In a supervised institution the audit trail is evidence, and evidence that cannot be handed to an examiner in a reviewable form is of limited use. This is the requirement described in what the ISO/IEC 42001 audit actually asks for — a management-system standard whose 38 Annex A controls under nine objectives expect exactly this kind of produced-not-reconstructed evidence.
ISO/IEC 42001 governance is built into the operating model rather than added afterwards: the model register, the approval trail and the evidence an auditor asks for are produced by the platform.
VERIFY: This describes the platform's alignment with the standard's control expectations. It is not a statement about any certification status — neither HAVAA's nor Yukon Labs' own. Confirm the current certification position before publishing any claim of certification.
How is tenant isolation enforced?
Through PostgreSQL Row-Level Security, at the database.
The distinction matters more than it sounds. Multi-tenant isolation implemented in application code depends on every query in every code path carrying the right filter. It works until one query does not, and the failure mode is a cross-tenant disclosure — the most serious incident class available to a multi-tenant system.
Row-Level Security moves the boundary into the database, where the policy applies regardless of which code path issued the query. A missing filter in application code no longer produces a disclosure.
For an institution running agents across departments, subsidiaries or client accounts, this is the control that makes shared infrastructure defensible in a security review.
How does knowledge and retrieval work?
Document ingestion with vector search and source citations, configured per agent so that each agent's expertise stays scoped to the corpus it should have.
Per-agent scoping is the useful property. An HR policy agent and a credit operations agent should not share a retrieval scope, and scoping at the agent level is simpler to reason about and to review than filtering a shared index at query time.
Source citations matter for the same reason they matter everywhere in enterprise AI: an answer without a source is only half a result, because the user cannot verify it and the audit trail cannot explain it. The retrieval quality mechanics behind this — chunking, metadata, hybrid search, evaluation — are in why context matters in enterprise AI.
What are autonomous missions?
Background execution with a Plan → Execute → Checkpoint → Evaluate loop, for scheduled and event-triggered work.
The checkpoint step is the part worth noticing. An autonomous loop without checkpoints is how agents run away — retrying a failing tool indefinitely, or drifting from the original task across many steps. Checkpointing makes the work resumable after a failure and gives the platform a place to evaluate progress before continuing, which is the practical answer to the loop failure mode.
Scheduled and event-triggered execution is also where the identity question becomes concrete: an agent running with no human present still acts as someone, and that principal should be narrowly scoped rather than shared.
Where does it sit alongside the data platform?
HAVAA is the orchestration layer. It does not replace the data platform beneath it, and its answer quality depends on that platform.
Yukon Labs deploys it inside the customer perimeter and connects it to governed data through Starburst, which provides federated query with row- and column-level access control applied consistently across sources, and OvalEdge, which provides the classification and business definitions the retrieval layer reads.
The division is clean. OvalEdge says what a data asset means and who may see it. Starburst executes governed queries across systems without moving data. HAVAA decides what happens in a conversation or a mission, enforces the safety mode, and records the trail. The architecture that binds them is in building a modern data platform.
What does a first deployment look like?
Three deployment topologies — SaaS, Docker Compose on a single server, or Kubernetes via Helm — with the same code path in all three, so a sovereign deployment is a configuration rather than a fork.
That property matters more than it appears. Where sovereign deployment means a separate build, the on-premise version lags the main product and diverges. Where it is a configuration, an institution that must run inside its own perimeter is not accepting an inferior version — which is the practical requirement behind sovereign AI.
A first engagement typically involves: deploying inside the perimeter, connecting to governed data, configuring safety modes and approval policies against the institution's risk appetite, setting token and capacity budgets, and starting with a read-only use case where errors are recoverable. Candidate use cases are in AI agent use cases across industries, and the selection criteria matter more than the technology.
[[TK: add first-deployment timelines and two anonymised customer outcomes once client approval is in writing. This article deliberately claims no customer results.]]
Key points
- HAVAA supplies builder, runtime, knowledge base, tools, safety modes and audit trail as one deployable artefact rather than as per-project code.
- The components that fail a compliance review — approvals, audit, isolation, redaction — are exactly the ones frameworks leave to you.
- Four safety modes replace the manual-or-autonomous binary with a ladder a deployment can climb as evidence accumulates.
- Capability is enforced by the runtime, not requested in a system prompt.
- PII redaction and prompt-injection detection run in the request path, and the audit trail is exportable as evidence.
- Tenant isolation is enforced by PostgreSQL Row-Level Security at the database, not by filters in application code.
- Retrieval is scoped per agent with source citations, so expertise stays bounded and answers stay verifiable.
- The same code path runs as SaaS, Docker Compose or Kubernetes, so sovereign deployment is a configuration rather than a fork.
Yukon Labs deploys HAVAA inside the customer perimeter in Azerbaijan, connected to governed data through Starburst and OvalEdge. Engagements start with a readiness assessment that establishes which use cases are reachable given the current estate. For the platform-selection framework, see choosing an enterprise AI platform.