A nine-layer AI application stack: the Republic.dev example

This guide describes a reference stack for an AI application with a public site, a staff admin, and reviewed data. The stack has nine layers. Republic.dev, a Devekko demo directory of industrial companies, is the example. Republic does not use all nine layers as described, so the table below gives the status of each one.

See the nine layers

Each layer has one job and one boundary that you can test. The Republic status comes from the project's deployment records, read on November 3, 2026.

Keep public and staff work separate

Public engagement. A Worker with Hono handles requests near the visitor. Add React only where a page needs complex browser state, such as a large filter or a comparison view. Republic serves its public pages from a Hono app and reads published Postgres views.

Staff admin. Deploy the admin as a separate Worker on its own hostname. Cloudflare Access puts a signed token in the Cf-Access-Jwt-Assertion header. Validate its signature, issuer, and audience in your code too, so that a route mistake does not expose the admin. Republic's admin also checks the origin of each request and a CSRF token on each form.

Access controls who can reach the admin. Your application still decides what each staff member can do, so keep roles in the application.

Make the data layer the source of truth

Define companies, products, sources, and review states as typed Pydantic models. API payloads, database mappers, and agent outputs then use one definition. This is the ontology in this stack.

Cloudflare Containers run Python beside your Workers, and a Worker starts and controls each container. Use a container for work that needs a full runtime, such as crawls or document extraction. In Republic, a Durable Object starts the container and sends requests to it.

Prefect runs the research flows and records each result. Pydantic AI makes an agent return a validated object. If the output is invalid, retry the call or reject the result. Republic keeps research output in a review state, and publication requires review.

Republic's Prefect flows run on a local host today, and selected outputs reach production. Decide where your flows run before you promise a refresh schedule.

Separate the gateway from the models

The three AI components do different jobs:

• AI Gateway controls calls to models. It gives you analytics, caching, and rate limits. Its custom providers can also reach a self-hosted model over HTTPS.
• Clef makes bounded decisions. Cloudflare's Clef models score the valid choices in a schema and return typed answers with probabilities. Clef is a model, not a gateway, so send its calls through the gateway too.
• Nemotron writes text. Workers AI hosts this NVIDIA model, and it supports tool calls.

Use Clef where your code needs a limited set of answers, such as a topic or an escalation. Use Nemotron where a person needs written text. Your code, and not the model, decides what each answer can start.

Gateway configuration is part of your privacy design. Republic's chat gateway has prompt logging and caching disabled. That configuration applies to the gateway only, so it does not prove zero data retention at each provider.

Limit what the chat can do

Cloudflare chat agents store messages, resume interrupted responses, and connect to React with a hook. A tool can also require user approval with needsApproval. Use this design when a conversation must continue across visits or when chat must take an action.

Republic's public chat is deliberately smaller. It is a custom dialog with no action tools. It keeps messages in page memory, and it does not send earlier messages to the model. Start with this level of access for an anonymous visitor.

Follow one question through the stack

The Ask Republic dialog shows how the layers connect:

1. The visitor types a question and passes a Turnstile check.
2. The Worker checks the origin, CSRF token, message size, and rate limit.
3. Clef-Omni, a Clef model, classifies the topic through AI Gateway.
4. A platform question gets fixed help text. An unsupported question gets a scope message.
5. A directory question retrieves a small set of published profiles.
6. Nemotron writes an answer from those public records.
7. The Worker returns plain text and adds trusted profile links.

The chat cannot read orders, sessions, private research drafts, or merchant administration. It cannot change a record or contact a person. The answer can still be wrong, so the visitor gets the source links.

Protect the database and add Palantir only for a clear need

Database. PlanetScale Postgres stores the system records, and Republic uses a runtime role with row-level security. Test this with two tenants. One tenant must not read the private records of the other. PlanetScale documents the Workers connection through Hyperdrive.

Secure intelligence. Republic does not use Palantir. Its ontology design refers to Palantir's public documentation, and the directory has an entry for Palantir as a company. This layer is a proposal for work that needs stronger controls than the application database gives.

Foundry markings require a user to hold all the markings on a resource, and they apply regardless of role. Markings also propagate to derived data. Row and column filters do not stay on data after a read, so a tool call or an export can carry that data out.

Use this layer if you analyze restricted data and must show who can see each derived result. Do not connect it to the public layer. Send only approved outputs to Postgres, and treat each transfer as a publication with a named approver. Get the cost and the contract terms from Palantir before you plan this layer.

Deploy and build with limited agent access

Deployment. Wrangler deploys Workers and their bindings. Cloudflare's agent skills teach coding agents how to use the platform. There is no single security skill in that repository. Use workers-best-practices for production review, cloudflare-one for Access, and turnstile-spin for bot checks. Run your own tests, because a skill gives guidance and does not prove that a release is safe. Republic deploys through the cf tool and a release script that adds its own checks.

Code development. OpenCode and Hermes can each use an OpenAI-compatible endpoint, so both can call Nemotron. Review each diff in VS Code. Hermes keeps persistent memory and can talk through messaging channels, so give it a separate account and no production credentials. Do not give any coding agent the production deployment token.

Choose the first layers to build

You do not need nine layers on the first day. Most first releases need the public layer, the data layer, and the database. Add the staff admin when a person must review records. Add AI when you can state each decision and each draft that a model produces. Add Palantir only for the need above.

Test the boundary column in the worksheet before you add the next layer. Then record the result and the date. A deployed component does not prove that its boundary holds.

The agentic workflow guide shows how to set approval limits for a first pilot. Devekko's AI and data service covers this type of work.

Your next step

Discuss your AI application

Share the task, your current systems, and the decision you need to make. We’ll discuss a useful first scope.

Discuss your AI application