Layer 2 — HTTP/API Edge
Express route setup, auth and tenant context, AI proxy routes, WorkflowCentral routes, configuration APIs, and gateway policy surfaces.
Every operator action and every external API call passes through this layer of the seven-layer code architecture first. Tenant identity is established here and propagated downward — no layer below re-derives tenant identity from request headers. Production AI traffic flows exclusively through governed proxy routes; the natural-language action surface is gated by an allowlist-based action gate (see Natural Language Action Gate).
Questions this layer answers
- Where is tenant context established?
- Which API routes participate in governance?
Ask them live on the Code Architecture Dashboard — click the second layer of the infographic.
Documentation & evidence
- MCP Gateway architecture — the gateway policy surface in detail
Related layers
- Layer 1 — User & Operator Surfaces — the surfaces whose requests this edge receives
- Layer 3 — Core Application Services — where validated requests become governed actions
- Layer 5 — Governance & Safety — the vertical safety rail invoked at this edge’s decision points
Last refreshed: 2026-07-06