Paladin, our AI agent for access governance, now runs in self-hosted Opal deployments.

If you run Opal inside your own infrastructure, you no longer have to choose between keeping the deployment there and getting AI-assisted access reviews. Same agent, same recommendations, same human sign-off, running where the rest of your Opal instance already runs.

How AI inference works in a self-hosted install

You choose the LLM provider. Bring your own Anthropic API key, or point Paladin at Amazon Bedrock in your own AWS account. The provider is configured inside your instance, so the inference path stays under your control.

What Paladin does in a review cycle

Paladin pulls entitlement data and usage signals from connected systems, then evaluates each grant against role, peer-group access, and last use. It returns a recommendation on every entitlement in scope: keep, revoke, or flag, with the supporting signals attached.

Paladin can autonomously approve or deny requests, or escalate the request to a human for action with reasoning attached.

How self-hosted Opal is deployed

Self-hosted Opal runs on infrastructure you stand up in your own AWS account, pulling images from your own private repositories. There are two install paths: KOTS, which gives you a Replicated-backed admin portal for configuration and updates, or the Helm chart directly, which takes more setup work and gives you more control over what gets deployed.

Getting started

Start with the self-hosted setup guide for prerequisites, then the AWS EKS deployment guide or Helm install guide. Or connect with our team.