FAQ

Is Ovara production-ready?

Ovara is under active construction toward V1.0.0. The gateway runs, the SDKs work, and the docs describe the real design - but treat everything here as pre-release: APIs may change, and hardening profiles are still being validated. Follow the repository for release updates.

How is this different from IAM?

IAM authenticates principals. Ovara governs each adaptive machine action: identity plus short-lived leases, per-action policy, live trust scoring, and a signed receipt. IAM answers "who are you"; Ovara answers "should this action happen right now, under this authority, in this environment, with this trust state."

How is this different from observability?

Observability records events. Ovara decides whether they should occur - then records the decision with a signature. Use both: Ovara emits OTLP/NATS telemetry into ClickHouse for the observe layer.

What happens when the gateway is down?

Design for fail-closed on consequential surfaces: if no decision can be produced, the action does not execute. Cache short-lived allow decisions for read-heavy paths, and keep the approval queue durable so escalations survive restarts.

Allow, deny, escalate - when does each fire?

• allow - identity valid, lease covers the action, policy permits, trust sufficient.
• deny - policy forbids, lease invalid or expired, chain suspicious beyond tolerance.
• escalate - policy requires human review (e.g. min_trust_score unmet), trust degraded, or chain patterns need eyes. Escalations enter continuations (escalated -> approved -> queued -> ready -> executed).

Can I try it without infrastructure?

Yes - build the single binary and run the demos:

cd OVARA/runtime/gateway
go build -o ovara-gateway ./cmd/server
./ovara-gateway
cd ../../examples && ./demo_safe_shell.sh

No cluster, no database, no cloud account. The TypeScript and Python SDKs talk to http://localhost:8080 out of the box.

Which language SDK should I use?

TypeScript (@ovara/sdk, 16-method client, retries with backoff, portable verification) for Node services; Python (ovara-sdk, async httpx, ed25519 verification) for agent code. Both verify receipts offline without gateway access.