> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Set up Paladin on self-hosted Opal

> Turn on Paladin in a self-hosted Opal deployment: connect a model provider, create the agent, run it on every request in monitor mode, and go live when you're ready.

## Overview

Paladin is not a separate service. It runs inside the Opal backend you already deploy, as a step in the access-request review flow. So turning Paladin on in a self-hosted install is a configuration task, not a new deployment: you connect a model provider, create the agent, and turn on Global Paladin to see its recommendations on every request.

This guide assumes you already run [self-hosted Opal](https://docs.opal.dev/docs/self-host-overview.md). If you don't, set that up first.

> [!NOTE]
>
> Paladin needs outbound access to a Claude model, either Anthropic's API or Amazon Bedrock. A fully air-gapped install cannot reach either endpoint, so Paladin is not available without egress to one of them. See [Connect a model provider](#step-1-connect-a-model-provider).

## Prerequisites

* A running self-hosted Opal install.
* Admin access to Opal.
* A model provider: either an Anthropic API key, or an AWS account with Amazon Bedrock and the Claude models enabled.

## Step 1: Connect a model provider

Paladin runs on Claude, through your own model account. You connect the account in Opal itself, so there's nothing to change in your deployment. Self-hosted installs don't have Opal's managed Anthropic account, so select **Anthropic - Your account** or **Amazon Bedrock - Your account**, not **Anthropic - Opal managed**.

Follow [Model providers](https://docs.opal.dev/docs/paladin/model-providers.md) to connect one, then make sure the Opal backend can reach it:

| Provider | Outbound HTTPS from the Opal backend to |
| - | - |
| Anthropic API | `api.anthropic.com` |
| Amazon Bedrock | The Bedrock runtime endpoint in your chosen region |

## Step 2: Create a Paladin agent

Follow [Create a Paladin agent](https://docs.opal.dev/docs/paladin/overview.md#create-a-paladin-agent): name it, assign an owner, leave **Monitor mode** on, and enable the connectors it should read from.

![The New Paladin agent dialog, with Name and Owner fields, Monitor mode and Show to admins only toggles, and connector toggles for Jira, Linear, Notion, and PagerDuty.](https://mintcdn.com/opalsecurity/PfcD7_PQsnIjFDg6/images/docs/paladin-create-agent-form.png?fit=max\&auto=format\&n=PfcD7_PQsnIjFDg6\&q=85\&s=4982911d192e25a6dfe29338531339c8)

Name the agent, pick an owner, and choose its mode and connectors.

## Step 3: Turn on Global Paladin

Start with Global Paladin rather than adding the agent to specific approval flows. It runs your agent in monitor mode on every access request, so Paladin records a recommendation on each one while your reviewers still approve or deny. You don't have to change any approval flows.

Under **Settings → AI Features**, turn on **Global Paladin** and select the agent you created. Global Paladin needs an agent in monitor mode. If you don't have one yet, Opal prompts you to create it. See [Global Paladin](https://docs.opal.dev/docs/paladin/access-request.md#global-paladin).

![The Global Paladin setting in AI Features, switched on, with an agent picker listing the Paladin agent.](https://mintcdn.com/opalsecurity/PfcD7_PQsnIjFDg6/images/docs/paladin-global-paladin.png?fit=max\&auto=format\&n=PfcD7_PQsnIjFDg6\&q=85\&s=7f9c769e675f77826b6a6a101e6018eb)

Turn on Global Paladin and select a monitor-mode agent.

## Step 4: Verify, then go live

Submit a test request and confirm Paladin's recommendation appears on it. Then watch its recommendations on real requests until you trust them.

When you're ready for Paladin to act, add an agent with monitor mode off as a reviewer on the approval flows you choose. See [Configure Paladin as a reviewer](https://docs.opal.dev/docs/paladin/access-request.md#configure-paladin-as-a-reviewer) for sole-reviewer versus advisory setups, and [Monitor mode](https://docs.opal.dev/docs/paladin/access-request.md#monitor-mode) for how to turn it off.

## Data handling

Paladin's decision records are stored in your own Opal database alongside the rest of your tenant's data. Its short-term working memory is held in Redis and expires within 24 hours. Prompts go only to the model provider you connected. See [Model providers](https://docs.opal.dev/docs/paladin/model-providers.md#data-handling). For a full data-flow and subprocessor breakdown for a security or compliance review, contact your Opal representative.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.