Genkit Middleware with Equitus.ai ArcXA, you leverage Genkit's modular framework to intercept, secure, and monitor data processing pipelines.
Because Genkit provides three specific interception hooks (model, tool, and generate), you can elegantly wrap your AI pipelines to handle authentication, context enrichment, and threat filtering required by Equitus ArcXA's secure enterprise fabric.
Here is how you can map and configure Genkit middleware to work seamlessly with ArcXA.
1. The Architectural Alignment
Genkit acts as your generative AI orchestration framework, while ArcXA provides your sovereign data, security, and enterprise infrastructure. When creating custom Genkit middleware for ArcXA, you will typically tap into one of three execution layers:
| Genkit Hook | What it Intercepts | ArcXA Integration Use Case |
| generate | The entire high-level loop (prompting, tool execution, parsing). | Sovereign Logging & Governance: Auditing the full request/response session for corporate compliance. |
| model | Direct raw exchanges with the LLM API. | Data Obfuscation / PII Masking: Scrubbing prompts before they leave the secure boundary or decrypting ArcXA protected vectors. |
| tool | Individual tool calls and execution. | RBAC (Role-Based Access Control): Enforcing ArcXA enterprise permissions before a model can run a specific operational tool. |
2. Implementing ArcXA via Custom Genkit Middleware
You can use Genkit's generateMiddleware helper to build a custom interceptor. Below is a TypeScript example demonstrating how to build an ArcXA security and compliance middleware that screens inputs and audits outputs.
import { genkit, generateMiddleware } from '@genkit-ai/core';
import { z } from 'zod';
import { ArcXAClient } from '@equitus/arcxa-sdk'; // Hypothethical ArcXA enterprise client
// Initialize your ArcXA secure client
const arcxa = new ArcXAClient({
apiKey: process.env.ARCXA_API_KEY,
tenantId: process.env.ARCXA_TENANT_ID,
});
/**
* Custom Genkit Middleware for Equitus.ai ArcXA Security Filtering
*/
export const arcxaSecurityMiddleware = generateMiddleware({
name: 'arcxaSecurity',
// Define configuration schemas if needed (e.g., security levels)
configSchema: z.object({
classificationLevel: z.enum(['public', 'internal', 'restricted']).default('internal'),
}),
// Hook into the high-level generation loop
hooks: {
generate: async (options, ctx, next) => {
// 1. Pre-execution: Intercept the prompt messages
const rawPrompt = options.messages?.map(m => m.content).join(' ') || '';
// Validate prompt against ArcXA data loss prevention (DLP) and threat intel
const securityCheck = await arcxa.security.inspectPrompt({
text: rawPrompt,
classification: ctx.config?.classificationLevel,
});
if (!securityCheck.isSafe) {
throw new Error(`ArcXA Security Blocked Request: ${securityCheck.reason}`);
}
// 2. Proceed to the next middleware or LLM model generation
const response = await next(options);
// 3. Post-execution: Audit and log the output back to ArcXA sovereign storage
await arcxa.audit.logTurn({
userId: ctx.userId || 'system',
prompt: rawPrompt,
response: response.text,
tokensUsed: response.usage?.totalTokens,
timestamp: new Date().toISOString(),
});
return response;
},
},
});
3. Applying the Middleware to Genkit Executions
Once your middleware is created, you pass it to your Genkit instance or plug it directly into a standalone generate() call.
const ai = genkit({});
const response = await ai.generate({
model: 'googleai/gemini-2.5-flash',
prompt: 'Analyze the quarterly logistics manifest from our sovereign database.',
// Inject the ArcXA middleware layer
use: [
arcxaSecurityMiddleware({ classificationLevel: 'restricted' })
],
});
console.log(response.text);
4. Hardening the Architecture with Existing Kits
Beyond writing custom middleware from scratch, you can chain ArcXA capabilities alongside Genkit's built-in official middleware to enforce strict air-gapped or enterprise constraints:
Tool Approval for Air-Gapped Actions: Use Genkit’s native
toolApprovalmiddleware alongside ArcXA's Identity Management. If Genkit wants to execute a tool that alters a protected database, the middleware triggers aToolInterruptError, holding the turn until an authorized user approves it via the ArcXA control panel.Resilience & Fallbacks: Pair ArcXA's self-hosted private models with cloud-fallback models using Genkit's
fallbackmiddleware. If your primary on-premise ArcXA model becomes throttled or encounters a transient hardware error, Genkit can gracefully fail over to a highly secured private cloud endpoint.
5. Debugging with the Genkit Dev UI
When you register your ArcXA middleware, it will automatically register within the Genkit Developer UI (accessible via genkit start). You can step through execution traces to see exactly what payload was sent to ArcXA for inspection, the latency added by the security check, and the modified clean prompt before it was processed by the underlying AI model.
The video below walks through how Genkit handles flows, custom tools, and middleware setups, which will help you structure how your server-side logic passes payloads into your middleware stack.
