diff --git a/public/docs-static/img/agent-network/overview/agent-network-control-center-v2.png b/public/docs-static/img/agent-network/overview/agent-network-control-center-v2.png new file mode 100644 index 00000000..348d3881 Binary files /dev/null and b/public/docs-static/img/agent-network/overview/agent-network-control-center-v2.png differ diff --git a/public/docs-static/img/agent-network/overview/agent-network-control-center.png b/public/docs-static/img/agent-network/overview/agent-network-control-center.png new file mode 100644 index 00000000..53442130 Binary files /dev/null and b/public/docs-static/img/agent-network/overview/agent-network-control-center.png differ diff --git a/public/docs-static/img/agent-network/overview/agent-network-internal-resources-policy.png b/public/docs-static/img/agent-network/overview/agent-network-internal-resources-policy.png new file mode 100644 index 00000000..537b3fab Binary files /dev/null and b/public/docs-static/img/agent-network/overview/agent-network-internal-resources-policy.png differ diff --git a/public/docs-static/img/agent-network/overview/agent-network-llm-policy.png b/public/docs-static/img/agent-network/overview/agent-network-llm-policy.png new file mode 100644 index 00000000..c029ed72 Binary files /dev/null and b/public/docs-static/img/agent-network/overview/agent-network-llm-policy.png differ diff --git a/public/docs-static/img/agent-network/policies/agent-network-access-log.png b/public/docs-static/img/agent-network/policies/agent-network-access-log.png new file mode 100644 index 00000000..511a545f Binary files /dev/null and b/public/docs-static/img/agent-network/policies/agent-network-access-log.png differ diff --git a/public/docs-static/img/agent-network/policies/agent-network-create-policy.png b/public/docs-static/img/agent-network/policies/agent-network-create-policy.png new file mode 100644 index 00000000..af697aa2 Binary files /dev/null and b/public/docs-static/img/agent-network/policies/agent-network-create-policy.png differ diff --git a/src/components/NavigationDocs.jsx b/src/components/NavigationDocs.jsx index b9d94f50..55817725 100644 --- a/src/components/NavigationDocs.jsx +++ b/src/components/NavigationDocs.jsx @@ -76,6 +76,45 @@ export const docsNavigation = [ { title: 'CLI', href: '/get-started/cli' }, ], }, + { + title: 'AGENT NETWORK', + links: [ + { title: 'Overview', href: '/agent-network' }, + { title: 'Quickstart', href: '/agent-network/quickstart' }, + { title: 'Providers', href: '/agent-network/providers' }, + { + title: 'Policies', + href: '/agent-network/policies', + links: [ + { + title: 'Token & Budget Limits', + href: '/agent-network/policies/limits', + }, + { title: 'Guardrails', href: '/agent-network/policies/guardrails' }, + ], + }, + { title: 'Global Limits', href: '/agent-network/global-limits' }, + { + title: 'Usage & Logs', + href: '/agent-network/usage-and-logs', + links: [ + { + title: 'Usage Overview', + href: '/agent-network/usage-and-logs/usage-overview', + }, + { + title: 'Access Logs', + href: '/agent-network/usage-and-logs/access-logs', + }, + { + title: 'Log Collection & Retention', + href: '/agent-network/usage-and-logs/log-collection', + }, + ], + }, + { title: 'Self-Hosting', href: '/agent-network/self-hosting' }, + ], + }, { title: 'MANAGE NETBIRD', links: [ diff --git a/src/pages/agent-network/index.mdx b/src/pages/agent-network/index.mdx new file mode 100644 index 00000000..4bb625e3 --- /dev/null +++ b/src/pages/agent-network/index.mdx @@ -0,0 +1,74 @@ +import { Note } from '@/components/mdx' + +export const description = + 'Agent Network is NetBird\'s control layer for AI agents — a keyless gateway to LLM APIs and scoped, identity-based access to your internal resources, all over the tunnel with per-identity policies, limits, and audit.' + +# NetBird Agent Network + +Agent Network is NetBird's control layer for AI agents. It gives every agent a +real network identity and governs what it can reach: +LLM APIs and AI gateways it can call, and the internal resources it can access. Traffic +flows only over the NetBird tunnel, scoped by policy, with no API keys or other credentials +to leak. + +

+ agent network +

+ + + Agent Network is currently in Beta. It is open source and can be self-hosted on your own infrastructure. + See the [GitHub repo](https://github.com/netbirdio/netbird/agent-network) for more details. + + +## Two Use Cases + +Agent Network is built on NetBird’s overlay network and reverse-proxy capabilities, giving any AI agent secure access +to LLM APIs and private resources. It works with human-in-the-loop tools like Claude Code and Codex, as well as fully autonomous +workloads running on VMs, Mac minis, or other infrastructure. Below are two specific use cases. + +### Keyless Gateway to LLM APIs for Cost Control and Auditing + +Your agents reach OpenAI, Anthropic, and AI gateways through a single +endpoint that's only reachable over the end-to-end encrypted tunnel. There is no need to +store or share API keys or other credentials. NetBird holds the provider API +key server-side, so it never reaches the caller, and every request is tied to a +real identity from your identity provider like Okta, Microsoft Entra ID, Google, +and others. That lets you apply per-identity policies, token and cost limits, model guardrails, and +full audit logs to outbound LLM traffic. + +

+ agent network llm policy +

+ +### Agentic Access to Internal Resources and Local Models + +Similarly, agents can securely reach internal resources such as databases, APIs, and private services that are not +exposed to the internet. This also covers private models served by Ollama, vLLM, or GPU clusters, giving agents secure +access over the same tunnel without public exposure. + +NetBird’s overlay network traverses firewalls and works across datacenters and cloud environments without opening ports, +configuring security groups, or changing network topology. Each agent connects with its own identity, and access policies +define exactly which resources it can reach, just like any other NetBird peer in the network. + +

+ agent network llm policy +

+ +## How NetBird Fits in Your Enterprise IT Stack + +It’s common for organizations to rely on a centralized identity provider like Okta, Microsoft Entra ID, Google, or others. +It’s also common for IT teams to manage access to internal resources while keeping costs under control. + +Traditionally, IT has done this through the internal network, using VPNs to give employees access to databases, web servers, +internal APIs, and other private services. + +AI agents should be treated the same way: as another trusted entity on the network. They need secure access to +internal resources, and modern enterprise resources now include LLMs and API endpoints alongside traditional infrastructure. +That makes agent access a natural responsibility for IT. + +Because NetBird connects seamlessly with existing identity providers, IT teams can integrate NetBird Agent Network into +their enterprise stack with minimal changes. + +## Next steps + +- [Quickstart](/agent-network/quickstart). Deploy NetBird Agent Network and make your first routed LLM call. \ No newline at end of file diff --git a/src/pages/agent-network/policies/index.mdx b/src/pages/agent-network/policies/index.mdx new file mode 100644 index 00000000..c8117508 --- /dev/null +++ b/src/pages/agent-network/policies/index.mdx @@ -0,0 +1,55 @@ +export const description = + 'Policies connect users and agents to AI providers, with optional token and budget limits plus guardrails for LLM access.' + +# Policies + +Policies connect users and agents (source groups) to AI providers — controlling +which identities can reach which providers and models, with optional limits and +guardrails. + +

+ agent network llm policy +

+ +## How Policies Work + +- **Source groups** — the users/agents the policy applies to. +- **Destination providers** — the providers the policy grants access to. +- **Limits** — optional per-user and per-group token and budget caps. +- **Guardrails** — optional model allowlist and prompt capture. + +A request is allowed when a policy connects the caller's groups to the resolved +provider and no applicable limit is exhausted. + +## Create a Policy + +1. Go to **Agent Network → Policies** and add a policy. +2. Choose the source groups and destination providers. +3. Optionally attach [limits](/agent-network/policies/limits) and + [guardrails](/agent-network/policies/guardrails). + +Try it out by calling your Agent Network endpoint. The access log will show the +policy in action: + +```bash +curl -vk https://sailcloth.netbird.ai/v1/chat/completions \ + --header "Content-Type: application/json" \ + --data '{ + "model": "gpt-5.5", + "messages": [ + { + "role": "user", + "content": "What is NetBird?" + } + ] + }' | jq +``` + +

+ agent network log +

+ +## More + +- [Token & Budget Limits](/agent-network/policies/limits) +- [Guardrails](/agent-network/policies/guardrails) \ No newline at end of file diff --git a/src/pages/agent-network/policies/limits.mdx b/src/pages/agent-network/policies/limits.mdx new file mode 100644 index 00000000..f3e4ce63 --- /dev/null +++ b/src/pages/agent-network/policies/limits.mdx @@ -0,0 +1,26 @@ +export const description = + 'Cap LLM token usage and spend per user or per group within a policy, over a rolling window.' + +# Token & Budget Limits + +Limits cap how much a policy's callers can consume. They come in two halves, +each enforceable per user and per group over a rolling window. + +## Token limits + +- **User cap** — maximum tokens per user in the window. +- **Group cap** — maximum tokens per group in the window. +- **Window** — the rolling period the cap applies to. + +## Budget limits + +- **User cap (USD)** — maximum spend per user in the window. +- **Group cap (USD)** — maximum spend per group in the window. +- **Window** — the rolling period the cap applies to. + +## How enforcement works + +Before each request, NetBird checks the applicable caps; when a cap is +exhausted, the request is denied with a reason surfaced in the +[access logs](/agent-network/usage-and-logs/access-logs). For account-wide caps +that apply across all policies, see [Global Limits](/agent-network/global-limits). \ No newline at end of file diff --git a/src/pages/agent-network/quickstart.mdx b/src/pages/agent-network/quickstart.mdx new file mode 100644 index 00000000..c537d2b4 --- /dev/null +++ b/src/pages/agent-network/quickstart.mdx @@ -0,0 +1,42 @@ +import { Note } from '@/components/mdx' + +export const description = + 'Get an LLM request routed through NetBird Agent Network end to end: connect a provider, create a policy, and make your first keyless call.' + +# Quickstart + +This guide takes you from zero to a working, keyless LLM call through Agent +Network in a few minutes. + + + You'll need an account with Agent Network enabled and at least one connected + peer (your agent or workstation) on the tunnel. + + +## 1. Connect a provider + +Add an AI provider (for example OpenAI) and paste its API key. NetBird stores +the key and exposes a tunnel-only endpoint in return. See +[Providers](/agent-network/providers). + +## 2. Create a policy + +Create a policy that connects a source group (your users or agents) to the +provider. See [Policies](/agent-network/policies). + +## 3. Make a request + +Point your LLM client at the Agent Network endpoint instead of the provider's +URL — no API key required from the client. + +```bash +# TODO: replace with the real endpoint + example request +curl https:///v1/chat/completions \ + -H "Content-Type: application/json" \ + -d '{"model":"gpt-4o","messages":[{"role":"user","content":"Hello"}]}' +``` + +## 4. See it in Usage & Logs + +Open [Usage & Logs](/agent-network/usage-and-logs) to confirm the request was +recorded, with the caller identity, model, tokens, and cost. \ No newline at end of file