# osamaqh4/hajiz-dlp-gateway architecture

> Architecture diagram of the GitHub repository osamaqh4/hajiz-dlp-gateway, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/osamaqh4/hajiz-dlp-gateway
- Repository: https://github.com/osamaqh4/hajiz-dlp-gateway

## Overview

Hajiz is an AI data-loss-prevention gateway for employee prompts and files. A client request enters through a provider adapter, is inspected by deterministic Tier A and—when warranted—semantic Tier B, then policy selects allow, pseudonymize, escalate, or block. The handler tokenizes approved spans, forwards sanitized content to the model, and restores values in ordinary and streamed replies. Audit records, live events, metrics, policy administration, and human escalation support governance and operations. The README documents these capabilities; some subsystem links use only the exact paths in the tree because their source was not sampled.

Main entry points: [`gateway/proxy/handler.js`](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/handler.js) (Request Handler), [`gateway/server.js`](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/server.js) (HTTP Gateway), [`dashboard/app.js`](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/dashboard/app.js) (Dashboard UI), [`gateway/detect/index.js`](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/index.js) (Tier Orchestrator)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_access["Gateway Access"]
  node_server["HTTP Gateway<br/>[server.js]"]
  node_adapters["Provider Adapters<br/>[adapters.js]"]
end

subgraph group_inspection["Detection"]
  node_detector["Tier Orchestrator<br/>[index.js]"]
  node_tier_a["Pattern Detection<br/>[index.js]"]
  node_patterns["Patterns And Checks<br/>[patterns.js]"]
  node_validators["Checksum Validators<br/>[validators.js]"]
  node_tier_b["Semantic Judge<br/>[judge.js]"]
end

subgraph group_privacy["Privacy Proxy"]
  node_handler["Request Handler<br/>[handler.js]"]
  node_vault["Token Vault<br/>[vault.js]"]
  node_sse["Stream Parser<br/>[sse.js]"]
end

subgraph group_governance["Governance"]
  node_policy["Policy Engine<br/>[policy.js]"]
  node_policy_file["Policy Rules<br/>[policy.yaml]"]
  node_audit[("Audit Log<br/>[audit.js]")]
  node_audit_file[("Audit Records")]
end

subgraph group_console["Operations Console"]
  node_events["Events And Metrics<br/>[events.js]"]
  node_dashboard["Dashboard UI<br/>[app.js]"]
end

node_employee(("Employee Client"))
node_judge_service(("Judge Endpoint"))
node_upstream(("AI Model API"))
node_reviewer(("Human Reviewer"))

node_employee -->|"sends request"| node_server
node_server -->|"selects adapter"| node_adapters
node_server -->|"dispatches request"| node_handler
node_handler -->|"extracts and rewrites"| node_adapters
node_handler -->|"submits prompt"| node_detector
node_detector -->|"scans text"| node_tier_a
node_tier_a -->|"runs patterns"| node_patterns
node_tier_a -->|"validates matches"| node_validators
node_detector -->|"judges when warranted"| node_tier_b
node_tier_b -.->|"sends text"| node_judge_service
node_handler -->|"requests decision"| node_policy
node_detector -->|"reads thresholds"| node_policy
node_policy -->|"loads and watches"| node_policy_file
node_handler -->|"tokenizes and restores"| node_vault
node_handler -->|"forwards sanitized request"| node_upstream
node_upstream -->|"returns model response"| node_handler
node_handler -->|"parses stream"| node_sse
node_handler -->|"appends decision"| node_audit
node_server -->|"verifies chain"| node_audit
node_audit -->|"reads and writes"| node_audit_file
node_handler -->|"publishes request events"| node_events
node_server -->|"reads events and metrics"| node_events
node_server -->|"serves interface"| node_dashboard
node_dashboard -->|"requests state and events"| node_server
node_dashboard -->|"submits review decision"| node_server
node_reviewer -->|"approves or declines"| node_dashboard
node_dashboard -->|"shows restored answer"| node_employee

click node_server "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/server.js"
click node_adapters "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/adapters.js"
click node_handler "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/handler.js"
click node_detector "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/index.js"
click node_tier_a "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierA/index.js"
click node_patterns "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierA/patterns.js"
click node_validators "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierA/validators.js"
click node_tier_b "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierB/judge.js"
click node_policy "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/policy/policy.js"
click node_policy_file "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/policy.yaml"
click node_vault "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/vault/vault.js"
click node_sse "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/sse.js"
click node_audit "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/audit/audit.js"
click node_events "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/lib/events.js"
click node_dashboard "https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/dashboard/app.js"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server,node_adapters,node_employee,node_reviewer toneBlue
class node_detector,node_tier_a,node_patterns,node_validators,node_tier_b toneAmber
class node_handler,node_vault,node_sse,node_upstream toneMint
class node_policy,node_policy_file,node_audit,node_audit_file toneRose
class node_events,node_dashboard,node_judge_service toneIndigo
```

## Components

### Gateway Access

- [HTTP Gateway](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/server.js): `gateway/server.js`
- [Provider Adapters](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/adapters.js): `gateway/proxy/adapters.js`

### Detection

- [Tier Orchestrator](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/index.js): `gateway/detect/index.js`
- [Pattern Detection](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierA/index.js): `gateway/detect/tierA/index.js`
- [Patterns And Checks](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierA/patterns.js): `gateway/detect/tierA/patterns.js`
- [Checksum Validators](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierA/validators.js): `gateway/detect/tierA/validators.js`
- [Semantic Judge](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/detect/tierB/judge.js): `gateway/detect/tierB/judge.js`

### Privacy Proxy

- [Request Handler](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/handler.js): `gateway/proxy/handler.js`
- [Token Vault](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/vault/vault.js): `gateway/vault/vault.js`
- [Stream Parser](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/proxy/sse.js): `gateway/proxy/sse.js`

### Governance

- [Policy Engine](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/policy/policy.js): `gateway/policy/policy.js`
- [Policy Rules](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/policy.yaml): `policy.yaml`
- [Audit Log](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/audit/audit.js): `gateway/audit/audit.js`
- **Audit Records**

### Operations Console

- [Events And Metrics](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/gateway/lib/events.js): `gateway/lib/events.js`
- [Dashboard UI](https://github.com/osamaqh4/hajiz-dlp-gateway/blob/main/dashboard/app.js): `dashboard/app.js`

### Other components

- **Employee Client**
- **Judge Endpoint**
- **AI Model API**
- **Human Reviewer**

## Connections

- Employee Client → HTTP Gateway: sends request
- HTTP Gateway → Provider Adapters: selects adapter
- HTTP Gateway → Request Handler: dispatches request
- Request Handler → Provider Adapters: extracts and rewrites
- Request Handler → Tier Orchestrator: submits prompt
- Tier Orchestrator → Pattern Detection: scans text
- Pattern Detection → Patterns And Checks: runs patterns
- Pattern Detection → Checksum Validators: validates matches
- Tier Orchestrator → Semantic Judge: judges when warranted
- Semantic Judge → Judge Endpoint: sends text
- Request Handler → Policy Engine: requests decision
- Tier Orchestrator → Policy Engine: reads thresholds
- Policy Engine → Policy Rules: loads and watches
- Request Handler → Token Vault: tokenizes and restores
- Request Handler → AI Model API: forwards sanitized request
- AI Model API → Request Handler: returns model response
- Request Handler → Stream Parser: parses stream
- Request Handler → Audit Log: appends decision
- HTTP Gateway → Audit Log: verifies chain
- Audit Log → Audit Records: reads and writes
- Request Handler → Events And Metrics: publishes request events
- HTTP Gateway → Events And Metrics: reads events and metrics
- HTTP Gateway → Dashboard UI: serves interface
- Dashboard UI → HTTP Gateway: requests state and events
- Dashboard UI → HTTP Gateway: submits review decision
- Human Reviewer → Dashboard UI: approves or declines
- Dashboard UI → Employee Client: shows restored answer