// inspect.operator_layer

OpenOrange operator layer

OpenOrange is the operator layer around private AI infrastructure: instance profiles, runtime adapters, dashboard signals, reviewed workflows, usage accounting, local secrets, and audit proof.

An operator layer is the control surface that makes private AI infrastructure governable. OpenOrange keeps runtime work observable, planned, approved, applied, smoked, and audited without moving live secrets, sessions, memories, or raw payloads into the control plane.

01

Private instance profiles define the operating boundary.

02

Runtime adapters connect agents, channels, tools, and model routes.

03

The dashboard keeps ownership, health, requests, costs, and approvals visible.

04

Plans, applies, smoke checks, and rollback metadata stay tied to audit records.

What it governs

OpenOrange governs the layer around execution: who owns an instance, which agents and adapters are attached, what model routes are available, which operations are proposed, what was approved, what changed, and what proof exists after the change.

What stays local

Runtime databases, sessions, memories, media, local caches, overlays, raw logs, and secret values stay on the runtime host or in the chosen secret backend. The operator layer stores references, observations, request attribution, plans, approvals, and audit context.

Why it matters

Scattered AI agents are hard to operate because every runtime invents its own health, approval, spend, privacy, and rollback story. OpenOrange makes those signals legible in one operated surface.

// questions

Is OpenOrange itself the runtime?

No. OpenOrange is the operator layer around runtimes. The runtime keeps execution; OpenOrange makes ownership, state, plans, approvals, usage, and proof visible.

Does the control plane need raw payloads?

No. Request traces can preserve actor, route, model, token, cost, cache, redaction state, and audit context without exposing raw payloads by default.