Relay

Teams shipping AI agents need enforceable guardrails — not prompt-only "please don't leak PII" — plus a place to see what the agent actually did. Relay is a policy gate for AI requests: a Go gateway and React AgentOps control plane to authenticate, run policies, queue risky writes for approval, and log redacted audit rows to Postgres. Adult supervision when agents need it.

Role: Platform engineering: gate, audit, control plane
Timeline: 04/2026 – Present
Stack: Go · PostgreSQL · React/Vite
Status: Sibling repo · demo URL when NEXT_PUBLIC_RELAY_DEMO_URL is set

Relay architecture: client to Go gate to policies to LLM with Postgres audit and control plane — Architecture — OpenAI-compatible gate, policies, audit, and control plane.

Gate the model. Approve the writes. Audit everything.

Project overview

The challenge

Agent demos without a control plane look like chat toys. Operators need PII blocks, model allowlists, spend caps, and human approval for writes — with an audit trail that never stores raw secrets.

My role

I scoped and built Relay as a separate service in Portfolio/relay: Go gate in front of Groq, Postgres audit, React control plane, smoke tests, and optional Astra integration via env.

Three pillars

OpenAI-compatible proxy: curl or Astra can swap a base URL and keep working.
Four MVP policies: PII block, model allowlist, session budget, write approval queue.
Operator UI: sessions, violations, policies, approvals, CSV/JSON export.

Exploration & discovery

Gateway vs SDK

Putting policy in a gateway keeps every client honest — including future agents — without forking each SDK. ADRs document gateway choice, immutable audit, and human-in-the-loop writes.

Interview-demo constraints

MVP had to be demoable without enterprise billing or multi-tenant complexity, while still showing real blocks and approvals.

Astra correlation

Optional portfolio path: RELAY_GATE_URL + RELAY_API_KEY with X-Relay-Session-ID so Astra turns appear in Relay audit.

Build & process

Go service authenticates, runs policies, queues write-class actions, routes classify tasks when configured, and writes redacted audit rows. React/Vite control plane talks to the admin API. Smoke tests cover gate, admin, and approval flow.

Policy set

PII block, model allowlist, session token budget, and write approval — enforced end-to-end on gated requests.

Four Relay MVP policies illustrated as cards — Four MVP policies — the operator story in one view.

Control plane

Overview metrics, sessions, violations, policy config, and pending approvals for human-in-the-loop writes.

Impact

Operator-of-AI story

Recruiters see agent (Astra) plus platform (Relay), not chat alone
Four policies enforced with smoke coverage
Architecture docs for gateway, audit, and approval design

How to try it

Run make dev in Portfolio/relay for local gate + UI, or set NEXT_PUBLIC_RELAY_DEMO_URL on the portfolio when a public demo is hosted. Case study diagrams explain the system when the demo URL is unset.

Reflections

Gateway keeps every client honest — including the portfolio agent.
Never store raw PII in audit: redact first, then log.
Approval queues make "agent writes" safe to demo in interviews.

Product shots

Swipe for more →

Relay architecture diagram — Architecture — gate, policies, audit, control plane.

Relay policies diagram — Four MVP policies.

Relay control plane illustration — Control plane — operator overview.