# Deployment topologies

One versioned API across laptop, on-prem and cloud/edge placements, with candid trust assumptions.

**Local Windows + WSL2 + Docker:** run planned APIs, identity, Postgres, policy and workers in containers; Windows-native connector as necessary. One compromised workstation defeats local isolation assumptions.

**Customer on-prem:** place secrets and protected connector on separately administered host with network segmentation and local identity/audit.

**Cloud + edge:** put the governance plane in cloud where desired, but hold credentials and resource access in an independently enforced local connector. All three use compatible versioned interfaces; deployment/topology remains a design, not a working 2ok distribution.

Status: design. This public documentation does not grant permissions.