Connectivity and trust boundaries

A reachable endpoint is not automatically an approved route. Amelfi evaluates target registration, transport compatibility, network policy, and credential requirements before upstream execution.

Managed routes

Managed data planes run within the provider boundary and reach explicitly approved public HTTPS targets. Register the target and its allowed operations before sending traffic. Redirects or a changed destination cannot be used to bypass the registered boundary.

Self-hosted private routes

Use self-hosted deployment for private-route requirements. A connector provides a controlled route into the intended network. Its state and route context must agree with the registered resource and the runtime configuration.

Check connectivity from the actual runtime path. A successful request from an administrator’s laptop does not prove that the data plane can resolve or reach the same target.

Diagnose in layers

Check	Evidence to inspect
Registration	Approved endpoint, transport, and route.
Connector	Current state and permitted network context.
Runtime	Readiness and accepted projection.
Request	Policy result, credential mode, and safe failure reason.

See connector management and troubleshooting.

Implementation reference

Read the source contract.