Skip to main content

AI Observability — Prerequisites

This page lists what a customer needs to bring before AI Observability is provisioned.

Prerequisites — SaaS​

In SaaS, AI Observability runs on Beak-managed infrastructure at observe.beakops.com.

Tenant and entitlement​

  • Active Beak AI Observability subscription — Sized by ingest rate (spans per minute), retention period, and number of evaluations.
  • Linked Studio/Runtime/Gateway tenants — Trace ingest is most useful when at least one of these products is also onboarded.

Identity and access​

  • Admin SSO — Microsoft Entra ID, Okta, Google Workspace, or any OIDC IdP for Observability admins, SREs, and AI engineers.
  • Project ownership model — Decide which IdP groups own which projects (a project is the unit of access control).

Network and connectivity​

  • Outbound from Studio, Runtime, and Gateway — All three send traces to observe.beakops.com over HTTPS. Allow-list this hostname on your egress.
  • Outbound from custom apps (optional) — Apps not built on Beak can also send traces; same outbound rule.
  • Inbound: none required — Observability does not need any inbound rule on your infrastructure.

Data retention and privacy​

  • Retention plan — Choose a retention window (30, 90, 180, or 365 days). Longer windows are billed accordingly.
  • PII handling — Decide whether prompts and completions are stored in full, redacted, or hash-only. The redaction policy is enforced before persistence.
  • Region selection — Pick a data region (US, EU, India). Affects where traces and evaluation data are stored.

Licensing​

  • Active Beak AI Observability subscription as above.

Customer responsibilities​

  • Defining projects, owners, and access groups.
  • Setting the retention and redaction policy.
  • Building evaluation datasets and reviewing regression alerts.
  • Reviewing audit trails for compliance.

Prerequisites — On-prem​

In On-prem, AI Observability runs on customer-managed Kubernetes. The platform is built on a streaming pipeline.

Infrastructure​

  • Kubernetes 1.28+ — Multi-node cluster sized for sustained ingest. Reference sizing for 1,000 spans/sec: 6 worker nodes × 16 vCPU / 64 GiB RAM each.
  • Object storage — S3-compatible, Azure Blob, or MinIO for long-term span storage.
  • Ingress — Customer-managed ingress with TLS termination for the Observability web UI and the trace ingest endpoint.

Data stores​

  • PostgreSQL 14+ with TimescaleDB and pgvector extensions — Single store for spans, traces, metrics, evaluations, alerts, and the configuration tables (projects, datasets, evaluation definitions, access control). TimescaleDB hypertables provide time-partitioned columnar-style compression for trace/span data; pgvector backs semantic drift detection. Sized to retention and ingest rate; reference: 8 vCPU / 64 GiB RAM, 1 TB NVMe SSD for 90-day retention at 1,000 spans/sec, scale vertically first then add read replicas.
  • Redis 6+ — Used for short-lived caches and rate limits on the ingest endpoint.

Identity and access​

  • Identity provider — On-prem AD (LDAP/LDAPS), Microsoft Entra ID, Okta, or any OIDC IdP. Same provider as the rest of the Beak AI suite is recommended.
  • TLS certificates — Corporate-CA-signed certificate for the Observability hostname.

Network and connectivity​

  • Trace ingest endpoint — Exposed internally on a dedicated subdomain (e.g., observe-ingest.<corp-domain>); Studio/Runtime/Gateway pods send to it.
  • No public exposure required — Observability can be fully internal.
  • Time sync — NTP on all nodes (required for span ordering).

Secrets and encryption​

  • Encryption key — Used to encrypt prompt/completion bodies at rest in object storage. Stored in the cluster's secret store.
  • Backup policy — Customer-defined backup of the PostgreSQL cluster (TimescaleDB-aware: use pg_dump for config tables and TimescaleDB's timescaledb-backup or PG base backups for hypertables) and the encryption key.

Licensing​

  • Active On-prem AI Observability subscription — Helm chart for the streaming stack and the dashboard, container images, and named-tenant entitlements.
  • Air-gapped option — Available; coordinate with Customer Success.

Customer responsibilities​

  • PostgreSQL (with TimescaleDB + pgvector) and Redis operations, or use a managed offering of each.
  • TLS certificate lifecycle.
  • IdP integration and project access mapping.
  • Retention, backup, and disaster recovery policies.
  • Capacity planning as agent volume grows.