Phase 1: The Platform Layer Before the LLM Call

Most LLM proxies start by forwarding HTTP. IBEX Harness starts by earning trust.

Phase 1 is complete. Before we call OpenAI, assemble context, or store a single memory, the platform validates every bearer token, verifies agent identity against the organization in the URL path, normalizes request bodies into a stable internal shape, and rejects traffic that fails any check. Chat routes return 501 PROVIDER_NOT_CONFIGURED on purpose — that response means auth, agent verification, and routing succeeded; provider forwarding ships in Phase 2.

This post explains what Phase 1 built, why we sequenced it this way, and how to run it locally in five minutes.

The problem Phase 1 solves

Persistent memory only matters if the proxy underneath it is secure, multi-tenant, and observable. A memory system bolted onto an unauthenticated proxy would leak context across organizations and fail the moment load spikes.

Phase 1 delivers the platform layer:

Phase 1 is deliberately not an LLM product yet. It is the hardened skeleton everything else attaches to.

What shipped

Twenty-two milestones across auth, proxy, observability, developer experience, and a security integration test suite. The highlights:

Auth service

• Postgres migrations for organizations, users, agents, and API tokens with Row-Level Security
• gRPC ValidateToken with Argon2id verification and a permission bitmap returned to callers
• Token lifecycle APIs — create, list, and revoke organization PATs
• Accepted ADRs for migration strategy and auth proto design

Proxy middleware chain

Every request to /v1/orgs/{org_id}/agents/{agent_id}/... passes through a ordered pipeline before handler logic runs:

See the full spec: Milestone 1.2.5 — proxy agent identity verification.

Observability and operations

• OpenTelemetry tracer provider registered across auth and proxy
• Prometheus metrics via the official Go client
• Shared structured logger package
• Health check contract for dependency readiness (/healthz, /readyz)

Security gate

Milestone 1.5.1 is the explicit Phase 1 exit gate: a cross-tenant security matrix covering token validation, agent mismatch, permission boundaries, and rate-limit behavior. Phase 1 did not ship without it.

Architecture at a glance

+-------------+             +-------+                    +--------------+     +----------------+
|             |             |       |                    |              |     |                |
| Agent / SDK |-HTTPS-:8080>| Proxy |    --gRPC-:9091--->|     Auth     |---->| Postgres + RLS |
|             |             |       |                    |              |     |                |
+-------------+             +-------+                    +--------------+     +----------------+
                                :                                                               
                                :                                                               
                                :                                                               
                                :                                                               
                                :                                                               
                                :                        +--------------+                       
                                :                        |              |                       
                                +----------------------->|    Redis     |                       
                                :                        |              |                       
                                :                        +--------------+                       
                                :                                                               
                                :                                                               
                                :                                                               
                                :                                                               
                                :                                                               
                                :                        +--------------+                       
                                :                        |              |                       
                                +........Phase.2........>| LLM provider |                       
                                                         |              |                       
                                                         +--------------+                       

What a successful request looks like today

Follow the Quickstart: boot Compose, run migrations, start auth and proxy, issue a PAT, then POST to the chat completions route.

A 501 PROVIDER_NOT_CONFIGURED response is success for Phase 1. It confirms:

1. Your bearer token validated over gRPC
2. The agent in the URL matched the token
3. Rate limiting and body parsing ran
4. The handler reached the provider slot — which is intentionally empty until Phase 2

Design choices worth knowing

Fail-closed auth. If validation cannot complete within the deadline, the proxy returns 503. We chose reliability of tenant isolation over best-effort forwarding.

Org-scoped URLs. Every proxy route embeds org_id and agent_id. The auth layer cross-checks both against the token — not just "is this token valid?" but "is this token valid for this agent in this org?"

Stable error envelope. All proxy errors share one JSON shape with code, message, request_id, and optional field errors. Integrators can branch on code without parsing prose.

Permission bitmap. Tokens carry a compact capability set returned from auth. Phase 2 provider routing and Phase 3 memory APIs will gate features on these bits — the contract is fixed in Phase 1.

What's next

Track delivery on the roadmap hub. For the memory story ahead of implementation, read The Journey of a Thought.

Get started

Phase 1 is the floor. Everything IBEX promises — learning agents, sub-20ms overhead, multi-tenant memory — builds on a proxy that refuses to forward untrusted traffic. That floor is in place.