diff --git a/.github/workflows/build-base-image.yml b/.github/workflows/build-base-image.yml
index 885bd353..b10855df 100644
--- a/.github/workflows/build-base-image.yml
+++ b/.github/workflows/build-base-image.yml
@@ -213,6 +213,25 @@ jobs:
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
 
+      - name: Update deployment image tag
+        if: github.event_name != 'pull_request'
+        run: |
+          cd deployment/base
+          TAG="${{ steps.version.outputs.version }}"
+          sed -i "s|newTag:.*|newTag: ${TAG}|" kustomization.yaml
+          echo "Updated deployment image tag to: ${TAG}"
+          cat kustomization.yaml | grep -A2 'images:'
+
+      - name: Commit deployment tag update
+        if: github.event_name != 'pull_request' && !startsWith(github.ref, 'refs/tags/')
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git add deployment/base/kustomization.yaml
+          git diff --cached --quiet && echo "No changes to commit" && exit 0
+          git commit -m "chore: update deployment image tag to ${{ steps.version.outputs.version }}"
+          git push origin HEAD:${{ github.ref_name }}
+
       - name: Create deployment package metadata
         if: github.event_name != 'pull_request'
         run: |
diff --git a/deployment/base/configmap.yaml b/deployment/base/configmap.yaml
index 29c49c32..634babe1 100644
--- a/deployment/base/configmap.yaml
+++ b/deployment/base/configmap.yaml
@@ -3,9 +3,15 @@ kind: ConfigMap
 metadata:
   name: agent-config
 data:
-  # Config Path (required for base image pattern)
-  # Config path — mount config/agent at this path (see Containerfile)
   CONFIG_PATH: "/app/config/agent"
-
-  # Note: PostgreSQL and Redis environment variables are added by
-  # optional components when postgres or redis components are included
+  AGENT_HOST: "0.0.0.0"
+  AGENT_PORT: "5002"
+  PYTHON_LOG_LEVEL: "INFO"
+  ENVIRONMENT: "production"
+  REQUEST_BODY_MAX_SIZE: "10485760"  # 10MB
+  REQUEST_LOG_BODY_MAX_SIZE: "10240"
+  LANGFUSE_TRACING_ENVIRONMENT: "production"
+  REDIS_URL: ""
+  POSTGRES_HOST: ""
+  POSTGRES_PORT: "5432"
+  POSTGRES_DB: "template_agent"
diff --git a/deployment/overlays/openshift/deployment.yaml b/deployment/base/deployment.yaml
similarity index 66%
rename from deployment/overlays/openshift/deployment.yaml
rename to deployment/base/deployment.yaml
index b7505684..f5838c15 100644
--- a/deployment/overlays/openshift/deployment.yaml
+++ b/deployment/base/deployment.yaml
@@ -24,15 +24,35 @@ spec:
     spec:
       serviceAccountName: agent
       terminationGracePeriodSeconds: 60
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    app: agent
+                    component: agent
+                topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: topology.kubernetes.io/zone
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              app: agent
+              component: agent
       containers:
         - name: agent
-          image: agent:latest
+          image: ghcr.io/redhat-data-and-ai/template-agent:latest
           imagePullPolicy: Always
           ports:
             - containerPort: 5002
               name: http
               protocol: TCP
           env:
+            - name: PYTHONUNBUFFERED
+              value: "1"
             - name: AGENT_HOST
               valueFrom:
                 configMapKeyRef:
@@ -46,7 +66,7 @@ spec:
             - name: ENABLE_AUTH
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: ENABLE_AUTH
             - name: PYTHON_LOG_LEVEL
               valueFrom:
@@ -137,6 +157,8 @@ spec:
                   name: agent-secrets
                   key: VLLM_API_KEY
                   optional: true
+            - name: DATABASE_URL
+              value: "postgresql://$(POSTGRES_USER):$(POSTGRES_PASSWORD)@$(POSTGRES_HOST):$(POSTGRES_PORT)/$(POSTGRES_DB)"
             - name: REDIS_URL
               valueFrom:
                 configMapKeyRef:
@@ -157,23 +179,82 @@ spec:
             - name: REQUEST_LOGGING_ENABLED
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: REQUEST_LOGGING_ENABLED
             - name: REQUEST_LOG_HEADERS
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: REQUEST_LOG_HEADERS
             - name: REQUEST_LOG_BODY
               valueFrom:
                 configMapKeyRef:
-                  name: agent-config
+                  name: agent-feature-flags
                   key: REQUEST_LOG_BODY
             - name: REQUEST_LOG_BODY_MAX_SIZE
               valueFrom:
                 configMapKeyRef:
                   name: agent-config
                   key: REQUEST_LOG_BODY_MAX_SIZE
+            - name: ENABLE_USER_ID_ENCRYPTION
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: ENABLE_USER_ID_ENCRYPTION
+            - name: ENABLE_OTEL_METRICS
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: ENABLE_OTEL_METRICS
+            - name: ENABLE_OTEL_TRACES
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: ENABLE_OTEL_TRACES
+            - name: PLATFORM_AUDIT_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: PLATFORM_AUDIT_ENABLED
+            - name: MIDDLEWARE_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: MIDDLEWARE_ENABLED
+            - name: REDIS_BROKER_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: REDIS_BROKER_ENABLED
+            - name: CONFIG_AUTO_RELOAD
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: CONFIG_AUTO_RELOAD
+            - name: CACHE_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: CACHE_ENABLED
+            - name: MEMORY_CONSOLIDATION_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: MEMORY_CONSOLIDATION_ENABLED
+            - name: OPA_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: OPA_ENABLED
+            - name: GUARDIAN_SSL_VERIFY
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-feature-flags
+                  key: GUARDIAN_SSL_VERIFY
+          lifecycle:
+            preStop:
+              exec:
+                command: ["sh", "-c", "sleep 5"]
           securityContext:
             runAsNonRoot: true
             allowPrivilegeEscalation: false
@@ -191,7 +272,6 @@ spec:
             httpGet:
               path: /health
               port: 5002
-            initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
             failureThreshold: 3
@@ -199,7 +279,6 @@ spec:
             httpGet:
               path: /health
               port: 5002
-            initialDelaySeconds: 10
             periodSeconds: 5
             timeoutSeconds: 3
             failureThreshold: 3
diff --git a/deployment/base/feature-flags.yaml b/deployment/base/feature-flags.yaml
new file mode 100644
index 00000000..a460227f
--- /dev/null
+++ b/deployment/base/feature-flags.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: agent-feature-flags
+data:
+  ENABLE_AUTH: "true"
+  ENABLE_USER_ID_ENCRYPTION: "true"
+  ENABLE_OTEL_METRICS: "true"
+  ENABLE_OTEL_TRACES: "true"
+  PLATFORM_AUDIT_ENABLED: "true"
+  REQUEST_LOGGING_ENABLED: "true"
+  REQUEST_LOG_HEADERS: "true"
+  REQUEST_LOG_BODY: "true"
+  MIDDLEWARE_ENABLED: "true"
+  REDIS_BROKER_ENABLED: "true"
+  CONFIG_AUTO_RELOAD: "true"
+  CACHE_ENABLED: "true"
+  CACHE_MODEL_ENABLED: "true"
+  CACHE_PERSONALIZATION_ENABLED: "true"
+  CACHE_METRICS_ENABLED: "true"
+  CACHE_WARMING_ENABLED: "true"
+  CACHE_REDIS_ENABLED: "true"
+  MEMORY_CONSOLIDATION_ENABLED: "true"
+  MEMORY_DECAY_ENABLED: "true"
+  MEMORY_CLUSTERING_ENABLED: "true"
+  MEMORY_RELATIONSHIPS_ENABLED: "true"
+  OPA_ENABLED: "true"
+  GUARDIAN_SSL_VERIFY: "true"
diff --git a/deployment/base/kustomization.yaml b/deployment/base/kustomization.yaml
index 367f497e..277d108d 100644
--- a/deployment/base/kustomization.yaml
+++ b/deployment/base/kustomization.yaml
@@ -1,12 +1,19 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
-# Core resources - always deployed
-# Postgres and Redis are now optional components
 resources:
+  - serviceaccount.yaml
   - configmap.yaml
+  - feature-flags.yaml
   - secret.yaml
+  - deployment.yaml
+  - service.yaml
 
 labels:
   - pairs:
-      app: template-agent
+      app: agent
+      component: agent
+
+images:
+  - name: ghcr.io/redhat-data-and-ai/template-agent
+    newTag: latest
diff --git a/deployment/base/secret.yaml b/deployment/base/secret.yaml
index 1b21c566..0b149daf 100644
--- a/deployment/base/secret.yaml
+++ b/deployment/base/secret.yaml
@@ -4,23 +4,16 @@ metadata:
   name: agent-secrets
 type: Opaque
 stringData:
-  # PostgreSQL credentials (default for in-cluster deployment)
   POSTGRES_USER: "postgres"
   POSTGRES_PASSWORD: "postgres"
-
-  # SSO / OIDC Authentication
   SSO_ISSUER_URL: ""
   SSO_CLIENT_ID: ""
   SSO_CLIENT_SECRET: ""
-
-  # Langfuse (optional - external service)
   LANGFUSE_PUBLIC_KEY: ""
   LANGFUSE_SECRET_KEY: ""
   LANGFUSE_BASE_URL: ""
-
-  # Google Vertex AI (optional)
   GOOGLE_APPLICATION_CREDENTIALS_CONTENT: ""
-
-  # vLLM / OpenAI-compatible (optional)
   VLLM_BASE_URL: ""
   VLLM_API_KEY: ""
+  SSL_KEYFILE: ""
+  SSL_CERTFILE: ""
diff --git a/deployment/overlays/openshift/service.yaml b/deployment/base/service.yaml
similarity index 100%
rename from deployment/overlays/openshift/service.yaml
rename to deployment/base/service.yaml
diff --git a/deployment/base/serviceaccount.yaml b/deployment/base/serviceaccount.yaml
new file mode 100644
index 00000000..3cb05f89
--- /dev/null
+++ b/deployment/base/serviceaccount.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: agent
+  labels:
+    app: agent
+    component: agent
+automountServiceAccountToken: false
diff --git a/deployment/components/postgres/kustomization.yaml b/deployment/components/postgres/kustomization.yaml
deleted file mode 100644
index 975f3db8..00000000
--- a/deployment/components/postgres/kustomization.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1alpha1
-kind: Component
-
-resources:
-  - deployment.yaml
-  - pvc.yaml
-  - service.yaml
-  - init-configmap.yaml
-
-patches:
-  - target:
-      kind: ConfigMap
-      name: agent-config
-    patch: |-
-      - op: add
-        path: /data/POSTGRES_HOST
-        value: "postgres"
-      - op: add
-        path: /data/POSTGRES_PORT
-        value: "5432"
-      - op: add
-        path: /data/POSTGRES_DB
-        value: "template_agent"
diff --git a/deployment/components/postgres/pvc.yaml b/deployment/components/postgres/pvc.yaml
deleted file mode 100644
index f9887241..00000000
--- a/deployment/components/postgres/pvc.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: postgres-pvc
-  annotations:
-    kubernetes.io/reclaimPolicy: Delete
-  labels:
-    component: database
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
diff --git a/deployment/components/postgres/service.yaml b/deployment/components/postgres/service.yaml
deleted file mode 100644
index ba4f27d6..00000000
--- a/deployment/components/postgres/service.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: postgres
-  labels:
-    component: database
-spec:
-  type: ClusterIP
-  ports:
-    - port: 5432
-      targetPort: 5432
-      protocol: TCP
-      name: postgres
-  selector:
-    component: database
diff --git a/deployment/components/redis/kustomization.yaml b/deployment/components/redis/kustomization.yaml
deleted file mode 100644
index 77ff980e..00000000
--- a/deployment/components/redis/kustomization.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1alpha1
-kind: Component
-
-resources:
-  - deployment.yaml
-  - pvc.yaml
-  - service.yaml
-
-patches:
-  - target:
-      kind: ConfigMap
-      name: agent-config
-    patch: |-
-      - op: add
-        path: /data/REDIS_URL
-        value: "redis://redis:6379/0"
diff --git a/deployment/components/redis/pvc.yaml b/deployment/components/redis/pvc.yaml
deleted file mode 100644
index 14385b0f..00000000
--- a/deployment/components/redis/pvc.yaml
+++ /dev/null
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: redis-pvc
-  annotations:
-    kubernetes.io/reclaimPolicy: Delete
-  labels:
-    component: cache
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
diff --git a/deployment/overlays/full/kustomization.yaml b/deployment/overlays/full/kustomization.yaml
new file mode 100644
index 00000000..248c5c97
--- /dev/null
+++ b/deployment/overlays/full/kustomization.yaml
@@ -0,0 +1,116 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ../openshift
+  - postgres-deployment.yaml
+  - pgbouncer.yaml
+  - postgres-service.yaml
+  - postgres-init-configmap.yaml
+  - redis-deployment.yaml
+  - redis-service.yaml
+
+patches:
+  # Point connection details at self-hosted services
+  - target:
+      kind: ConfigMap
+      name: agent-config
+    patch: |-
+      - op: replace
+        path: /data/POSTGRES_HOST
+        value: "postgres"
+      - op: replace
+        path: /data/REDIS_URL
+        value: "redis://redis:6379/0"
+
+  # PostgreSQL resource limits and tuning
+  - target:
+      kind: StatefulSet
+      name: postgres
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/requests/memory
+        value: "1Gi"
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/requests/cpu
+        value: "500m"
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/limits/memory
+        value: "2Gi"
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/limits/cpu
+        value: "2000m"
+      - op: add
+        path: /spec/template/spec/containers/0/args
+        value:
+          - "-c"
+          - "max_connections=300"
+          - "-c"
+          - "shared_buffers=512MB"
+          - "-c"
+          - "effective_cache_size=1536MB"
+          - "-c"
+          - "work_mem=8MB"
+          - "-c"
+          - "maintenance_work_mem=256MB"
+          - "-c"
+          - "wal_buffers=16MB"
+          - "-c"
+          - "checkpoint_completion_target=0.9"
+          - "-c"
+          - "random_page_cost=1.1"
+          - "-c"
+          - "effective_io_concurrency=200"
+          - "-c"
+          - "huge_pages=off"
+          - "-c"
+          - "jit=off"
+      - op: replace
+        path: /spec/volumeClaimTemplates/0/spec/resources/requests/storage
+        value: "10Gi"
+
+  # Redis resource limits and tuning
+  - target:
+      kind: StatefulSet
+      name: redis
+    patch: |-
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/requests/memory
+        value: "256Mi"
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/limits/memory
+        value: "512Mi"
+      - op: replace
+        path: /spec/template/spec/containers/0/resources/limits/cpu
+        value: "500m"
+      - op: replace
+        path: /spec/template/spec/containers/0/command
+        value:
+          - redis-server
+          - --appendonly
+          - "yes"
+          - --appendfsync
+          - everysec
+          - --no-appendfsync-on-rewrite
+          - "yes"
+          - --maxmemory
+          - 450mb
+          - --maxmemory-policy
+          - allkeys-lru
+          - --maxclients
+          - "2000"
+          - --tcp-keepalive
+          - "300"
+          - --tcp-backlog
+          - "2048"
+          - --hz
+          - "50"
+          - --activedefrag
+          - "yes"
+          - --lazyfree-lazy-eviction
+          - "yes"
+          - --lazyfree-lazy-expire
+          - "yes"
+      - op: replace
+        path: /spec/volumeClaimTemplates/0/spec/resources/requests/storage
+        value: "5Gi"
diff --git a/deployment/overlays/full/pgbouncer.yaml b/deployment/overlays/full/pgbouncer.yaml
new file mode 100644
index 00000000..15f2bf51
--- /dev/null
+++ b/deployment/overlays/full/pgbouncer.yaml
@@ -0,0 +1,88 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pgbouncer
+  labels:
+    component: connection-pool
+spec:
+  replicas: 2
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  selector:
+    matchLabels:
+      component: connection-pool
+  template:
+    metadata:
+      labels:
+        component: connection-pool
+    spec:
+      containers:
+        - name: pgbouncer
+          image: docker.io/bitnami/pgbouncer:1
+          env:
+            - name: POSTGRESQL_HOST
+              value: "postgres-backend"
+            - name: POSTGRESQL_PORT
+              value: "5432"
+            - name: POSTGRESQL_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: agent-secrets
+                  key: POSTGRES_USER
+            - name: POSTGRESQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: agent-secrets
+                  key: POSTGRES_PASSWORD
+            - name: POSTGRESQL_DATABASE
+              valueFrom:
+                configMapKeyRef:
+                  name: agent-config
+                  key: POSTGRES_DB
+            - name: PGBOUNCER_POOL_MODE
+              value: "transaction"
+            - name: PGBOUNCER_MAX_CLIENT_CONN
+              value: "2000"
+            - name: PGBOUNCER_DEFAULT_POOL_SIZE
+              value: "50"
+            - name: PGBOUNCER_MIN_POOL_SIZE
+              value: "10"
+            - name: PGBOUNCER_RESERVE_POOL_SIZE
+              value: "15"
+            - name: PGBOUNCER_MAX_DB_CONNECTIONS
+              value: "75"
+          ports:
+            - containerPort: 6432
+              name: pgbouncer
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: 6432
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 6432
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "250m"
+          securityContext:
+            runAsNonRoot: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      restartPolicy: Always
diff --git a/deployment/components/postgres/deployment.yaml b/deployment/overlays/full/postgres-deployment.yaml
similarity index 84%
rename from deployment/components/postgres/deployment.yaml
rename to deployment/overlays/full/postgres-deployment.yaml
index b6a5a0c1..2cfa0d43 100644
--- a/deployment/components/postgres/deployment.yaml
+++ b/deployment/overlays/full/postgres-deployment.yaml
@@ -1,13 +1,12 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
-  name: pgvector
+  name: postgres
   labels:
     component: database
 spec:
+  serviceName: postgres-backend
   replicas: 1
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       component: database
@@ -17,8 +16,8 @@ spec:
         component: database
     spec:
       containers:
-        - name: pgvector
-          image: pgvector/pgvector:pg16
+        - name: postgres
+          image: docker.io/pgvector/pgvector:pg16
           env:
             - name: POSTGRES_USER
               valueFrom:
@@ -46,7 +45,7 @@ spec:
               command:
                 - pg_isready
                 - -U
-                - pgvector
+                - postgres
             initialDelaySeconds: 30
             periodSeconds: 10
             timeoutSeconds: 5
@@ -56,7 +55,7 @@ spec:
               command:
                 - pg_isready
                 - -U
-                - pgvector
+                - postgres
             initialDelaySeconds: 5
             periodSeconds: 5
             timeoutSeconds: 3
@@ -80,10 +79,18 @@ spec:
               drop:
                 - ALL
       volumes:
-        - name: postgres-data
-          persistentVolumeClaim:
-            claimName: postgres-pvc
         - name: postgres-init
           configMap:
             name: postgres-init
       restartPolicy: Always
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+        labels:
+          component: database
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 5Gi
diff --git a/deployment/components/postgres/init-configmap.yaml b/deployment/overlays/full/postgres-init-configmap.yaml
similarity index 100%
rename from deployment/components/postgres/init-configmap.yaml
rename to deployment/overlays/full/postgres-init-configmap.yaml
diff --git a/deployment/overlays/full/postgres-service.yaml b/deployment/overlays/full/postgres-service.yaml
new file mode 100644
index 00000000..02f22a60
--- /dev/null
+++ b/deployment/overlays/full/postgres-service.yaml
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres
+  labels:
+    component: connection-pool
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5432
+      targetPort: 6432
+      protocol: TCP
+      name: postgres
+  selector:
+    component: connection-pool
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-backend
+  labels:
+    component: database
+spec:
+  type: ClusterIP
+  clusterIP: None
+  ports:
+    - port: 5432
+      targetPort: 5432
+      protocol: TCP
+      name: postgres
+  selector:
+    component: database
diff --git a/deployment/components/redis/deployment.yaml b/deployment/overlays/full/redis-deployment.yaml
similarity index 66%
rename from deployment/components/redis/deployment.yaml
rename to deployment/overlays/full/redis-deployment.yaml
index 18dfe2d7..ca208865 100644
--- a/deployment/components/redis/deployment.yaml
+++ b/deployment/overlays/full/redis-deployment.yaml
@@ -1,10 +1,11 @@
 apiVersion: apps/v1
-kind: Deployment
+kind: StatefulSet
 metadata:
   name: redis
   labels:
     component: cache
 spec:
+  serviceName: redis
   replicas: 1
   selector:
     matchLabels:
@@ -16,15 +17,33 @@ spec:
     spec:
       containers:
         - name: redis
-          image: redis:7-alpine
+          image: docker.io/redis:7-alpine
           command:
             - redis-server
             - --appendonly
             - "yes"
+            - --appendfsync
+            - "everysec"
+            - --no-appendfsync-on-rewrite
+            - "yes"
             - --maxmemory
             - "256mb"
             - --maxmemory-policy
             - "allkeys-lru"
+            - --maxclients
+            - "2000"
+            - --tcp-keepalive
+            - "300"
+            - --tcp-backlog
+            - "2048"
+            - --hz
+            - "50"
+            - --activedefrag
+            - "yes"
+            - --lazyfree-lazy-eviction
+            - "yes"
+            - --lazyfree-lazy-expire
+            - "yes"
           ports:
             - containerPort: 6379
               name: redis
@@ -63,8 +82,15 @@ spec:
             capabilities:
               drop:
                 - ALL
-      volumes:
-        - name: redis-data
-          persistentVolumeClaim:
-            claimName: redis-pvc
       restartPolicy: Always
+  volumeClaimTemplates:
+    - metadata:
+        name: redis-data
+        labels:
+          component: cache
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 1Gi
diff --git a/deployment/components/redis/service.yaml b/deployment/overlays/full/redis-service.yaml
similarity index 100%
rename from deployment/components/redis/service.yaml
rename to deployment/overlays/full/redis-service.yaml
diff --git a/deployment/overlays/kind/README.md b/deployment/overlays/kind/README.md
deleted file mode 100644
index 1015c17b..00000000
--- a/deployment/overlays/kind/README.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# Kind Cluster Deployment
-
-Deploy the full stack (UI + Agent + MCP Server + infrastructure) to a local Kubernetes cluster using [Kind](https://kind.sigs.k8s.io/).
-
-## Prerequisites
-
-- `kind` — [install](https://kind.sigs.k8s.io/docs/user/quick-start/#installation)
-- `kubectl`
-- `podman` or `docker` (for building images)
-
-## Quick Start
-
-```bash
-make kind
-```
-
-This single command will:
-
-1. Clone `template-mcp-server` and `template-ui` repos into `.kind/`
-2. Create a Kind cluster with ingress support
-3. Build all three images (agent, MCP server, UI) and load them into Kind
-4. Deploy the full stack via Kustomize
-5. Wait for all pods to be ready
-
-## What's deployed
-
-| Service | Image | Port | Ingress |
-|---------|-------|------|---------|
-| UI | template-ui:local | 8080 | http://ui.localhost |
-| Agent | template-agent:local | 5002 | http://agent.localhost |
-| MCP Server | template-mcp-server:local | 5001 | http://mcp.localhost |
-| Postgres (pgvector) | pgvector/pgvector:pg16 | 5432 | — |
-| Redis | redis:7-alpine | 6379 | — |
-| Jaeger | jaegertracing/all-in-one | 16686 | http://jaeger.localhost |
-
-## Useful Commands
-
-```bash
-kubectl -n template-agent get pods
-kubectl -n template-agent logs -l component=agent -f
-kubectl -n template-agent logs -l component=mcp-server -f
-kubectl -n template-agent logs -l component=ui -f
-```
-
-## Port-Forward (alternative to Ingress)
-
-```bash
-kubectl -n template-agent port-forward svc/ui 8080:8080
-kubectl -n template-agent port-forward svc/agent 5002:5002
-kubectl -n template-agent port-forward svc/mcp-server 5001:5001
-```
-
-## Differences from OpenShift
-
-| Concern | Kind | OpenShift |
-|---------|------|-----------|
-| Image build | Local `podman build` + `kind load` | BuildConfig (in-cluster) |
-| Routing | NGINX Ingress | Route |
-| Image pull | `imagePullPolicy: Never` | ImageStream |
-| Security | Default PSA | SCC (restricted) |
-| Storage | Default StorageClass | OpenShift PVs |
-
-## Teardown
-
-```bash
-make kind-down
-```
diff --git a/deployment/overlays/kind/deployment.yaml b/deployment/overlays/kind/deployment.yaml
deleted file mode 100644
index 369fd265..00000000
--- a/deployment/overlays/kind/deployment.yaml
+++ /dev/null
@@ -1,119 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: agent
-  labels:
-    app: agent
-    component: agent
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: agent
-      component: agent
-  template:
-    metadata:
-      labels:
-        app: agent
-        component: agent
-    spec:
-      containers:
-        - name: agent
-          image: agent:local
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 5002
-              name: http
-              protocol: TCP
-          env:
-            - name: AGENT_HOST
-              value: "0.0.0.0"
-            - name: AGENT_PORT
-              value: "5002"
-            - name: PYTHON_LOG_LEVEL
-              value: "INFO"
-            - name: POSTGRES_HOST
-              valueFrom:
-                configMapKeyRef:
-                  name: agent-config
-                  key: POSTGRES_HOST
-            - name: POSTGRES_PORT
-              valueFrom:
-                configMapKeyRef:
-                  name: agent-config
-                  key: POSTGRES_PORT
-            - name: POSTGRES_DB
-              valueFrom:
-                configMapKeyRef:
-                  name: agent-config
-                  key: POSTGRES_DB
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: agent-secrets
-                  key: POSTGRES_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: agent-secrets
-                  key: POSTGRES_PASSWORD
-            - name: REDIS_URL
-              valueFrom:
-                configMapKeyRef:
-                  name: agent-config
-                  key: REDIS_URL
-            - name: GOOGLE_APPLICATION_CREDENTIALS_CONTENT
-              valueFrom:
-                secretKeyRef:
-                  name: agent-secrets
-                  key: GOOGLE_APPLICATION_CREDENTIALS_CONTENT
-                  optional: true
-            - name: LANGFUSE_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: agent-secrets
-                  key: LANGFUSE_PUBLIC_KEY
-                  optional: true
-            - name: LANGFUSE_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: agent-secrets
-                  key: LANGFUSE_SECRET_KEY
-                  optional: true
-            - name: LANGFUSE_BASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: agent-secrets
-                  key: LANGFUSE_BASE_URL
-                  optional: true
-          startupProbe:
-            httpGet:
-              path: /health
-              port: 5002
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            failureThreshold: 30
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 5002
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 5002
-            initialDelaySeconds: 10
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-      restartPolicy: Always
diff --git a/deployment/overlays/kind/ingress.yaml b/deployment/overlays/kind/ingress.yaml
deleted file mode 100644
index 2133dcb9..00000000
--- a/deployment/overlays/kind/ingress.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: template-agent-ingress
-  labels:
-    app: template-agent
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-buffering: "off"
-spec:
-  rules:
-    - host: ui.localhost
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: ui
-                port:
-                  number: 8080
-    - host: agent.localhost
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: agent
-                port:
-                  number: 5002
-    - host: jaeger.localhost
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: jaeger
-                port:
-                  number: 16686
diff --git a/deployment/overlays/kind/kustomization.yaml b/deployment/overlays/kind/kustomization.yaml
deleted file mode 100644
index 1052c16a..00000000
--- a/deployment/overlays/kind/kustomization.yaml
+++ /dev/null
@@ -1,28 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: template-agent
-
-resources:
-  - ../../base
-  - deployment.yaml
-  - service.yaml
-  - ui.yaml
-  - ingress.yaml
-
-# Include postgres and redis for local development
-components:
-  - ../../components/postgres
-  - ../../components/redis
-
-labels:
-  - pairs:
-      app: template-agent
-
-images:
-  - name: agent
-    newName: localhost/template-agent
-    newTag: local
-  - name: template-ui
-    newName: localhost/template-ui
-    newTag: local
diff --git a/deployment/overlays/kind/ui.yaml b/deployment/overlays/kind/ui.yaml
deleted file mode 100644
index 8e28c826..00000000
--- a/deployment/overlays/kind/ui.yaml
+++ /dev/null
@@ -1,133 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ui
-  labels:
-    app: template-agent
-    component: ui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      component: ui
-  template:
-    metadata:
-      labels:
-        app: template-agent
-        component: ui
-    spec:
-      containers:
-        - name: ui
-          image: localhost/template-ui:local
-          imagePullPolicy: Never
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          env:
-            - name: PORT
-              value: "8080"
-            - name: ENVIRONMENT
-              value: "development"
-            - name: AUTH_ENABLED
-              value: "false"
-            - name: AGENT_HOST
-              value: "http://agent:5002"
-            - name: UI_CONFIG_PATH
-              value: "/etc/config/ui.yaml"
-            - name: REDIS_HOST
-              valueFrom:
-                configMapKeyRef:
-                  name: agent-config
-                  key: REDIS_HOST
-            - name: REDIS_PORT
-              valueFrom:
-                configMapKeyRef:
-                  name: agent-config
-                  key: REDIS_PORT
-          volumeMounts:
-            - name: ui-config
-              mountPath: /etc/config
-              readOnly: true
-          readinessProbe:
-            httpGet:
-              path: /api/health
-              port: 8080
-            initialDelaySeconds: 10
-            periodSeconds: 5
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "256Mi"
-              cpu: "250m"
-      volumes:
-        - name: ui-config
-          configMap:
-            name: ui-config
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: ui-config
-  labels:
-    app: template-agent
-    component: ui
-data:
-  ui.yaml: |
-    server:
-      host: "0.0.0.0"
-      port: 8080
-      body_limit: 1048576
-    logging:
-      level: info
-    cors:
-      origin: "http://localhost:5173"
-    security:
-      helmet:
-        enabled: true
-        csp:
-          default_src: ["'self'"]
-          script_src: ["'self'", "'unsafe-inline'"]
-          style_src: ["'self'", "'unsafe-inline'"]
-          img_src: ["'self'", "data:", "blob:"]
-          connect_src: ["'self'"]
-          font_src: ["'self'"]
-          object_src: ["'none'"]
-          frame_ancestors: ["'none'"]
-        cross_origin_embedder_policy: false
-      rate_limit:
-        enabled: true
-        max: 100
-        window: "1 minute"
-        exclude_paths:
-          - "/api/health"
-          - "/_health"
-      session:
-        secure_cookie: false
-        max_age_days: 30
-    otel:
-      enabled: false
-      service_name: "template-ui"
-    announcement:
-      enabled: false
-      message: ""
-      type: info
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: ui
-  labels:
-    app: template-agent
-    component: ui
-spec:
-  selector:
-    component: ui
-  ports:
-    - port: 8080
-      targetPort: 8080
-      protocol: TCP
-      name: http
-  type: ClusterIP
diff --git a/deployment/overlays/openshift/buildconfig.yaml b/deployment/overlays/openshift/buildconfig.yaml
deleted file mode 100644
index b6ff9f63..00000000
--- a/deployment/overlays/openshift/buildconfig.yaml
+++ /dev/null
@@ -1,29 +0,0 @@
-apiVersion: build.openshift.io/v1
-kind: BuildConfig
-metadata:
-  name: agent
-  labels:
-    app: agent
-    component: agent
-spec:
-  successfulBuildsHistoryLimit: 1
-  failedBuildsHistoryLimit: 1
-  output:
-    to:
-      kind: ImageStreamTag
-      name: agent:latest
-  source:
-    type: Binary
-    binary: {}
-  strategy:
-    type: Docker
-    dockerStrategy:
-      dockerfilePath: Containerfile
-  resources:
-    requests:
-      memory: "2Gi"
-      cpu: "1000m"
-    limits:
-      memory: "4Gi"
-      cpu: "4"
-  triggers: []
diff --git a/deployment/overlays/openshift/configmap-patch.yaml b/deployment/overlays/openshift/configmap-patch.yaml
deleted file mode 100644
index de546ffa..00000000
--- a/deployment/overlays/openshift/configmap-patch.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: agent-config
-data:
-  # OpenShift-specific config
-  AGENT_HOST: "0.0.0.0"
-  AGENT_PORT: "5002"
-  PYTHON_LOG_LEVEL: "INFO"
-
-  # Environment & Security
-  ENVIRONMENT: "production"
-  ENABLE_AUTH: "true"
-  REQUEST_BODY_MAX_SIZE: "10485760"  # 10MB
-
-  # Request Logging
-  REQUEST_LOGGING_ENABLED: "true"
-  REQUEST_LOG_HEADERS: "true"
-  REQUEST_LOG_BODY: "false"
-  REQUEST_LOG_BODY_MAX_SIZE: "10240"
-
-  # Observability
-  LANGFUSE_TRACING_ENVIRONMENT: "production"
-
-  # Redis
-  REDIS_URL: "redis://redis:6379/0"
diff --git a/deployment/overlays/openshift/hpa.yaml b/deployment/overlays/openshift/hpa.yaml
index eafc1282..d8cec0ec 100644
--- a/deployment/overlays/openshift/hpa.yaml
+++ b/deployment/overlays/openshift/hpa.yaml
@@ -10,39 +10,30 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: agent
-  minReplicas: 2  # HA baseline - handles ~20-40 concurrent users
-  maxReplicas: 10  # Peak capacity - handles ~100-150 concurrent users
+  minReplicas: 2
+  maxReplicas: 10
   metrics:
     - type: Resource
       resource:
         name: cpu
         target:
           type: Utilization
-          averageUtilization: 70  # Scale up when CPU > 70%
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          type: Utilization
-          averageUtilization: 75  # Scale up when memory > 75%
+          averageUtilization: 60
   behavior:
     scaleUp:
-      stabilizationWindowSeconds: 60  # Wait 60s before scaling up
+      stabilizationWindowSeconds: 30
       policies:
         - type: Percent
-          value: 50  # Scale up by 50% (1→2, 2→3, 4→6)
+          value: 100
           periodSeconds: 60
         - type: Pods
-          value: 2  # Or add 2 pods at once
+          value: 4
           periodSeconds: 60
-      selectPolicy: Max  # Use whichever policy scales faster
+      selectPolicy: Max
     scaleDown:
-      stabilizationWindowSeconds: 300  # Wait 5min before scaling down
+      stabilizationWindowSeconds: 300
       policies:
         - type: Percent
-          value: 25  # Scale down by 25% at a time
-          periodSeconds: 60
-        - type: Pods
-          value: 1  # Or remove 1 pod at once
-          periodSeconds: 180
-      selectPolicy: Min  # Use whichever policy scales slower (conservative)
+          value: 25
+          periodSeconds: 120
+      selectPolicy: Min
diff --git a/deployment/overlays/openshift/imagestream.yaml b/deployment/overlays/openshift/imagestream.yaml
deleted file mode 100644
index 5d9ec3d8..00000000
--- a/deployment/overlays/openshift/imagestream.yaml
+++ /dev/null
@@ -1,10 +0,0 @@
-apiVersion: image.openshift.io/v1
-kind: ImageStream
-metadata:
-  name: agent
-  labels:
-    app: agent
-    component: agent
-spec:
-  lookupPolicy:
-    local: true
diff --git a/deployment/overlays/openshift/kustomization.yaml b/deployment/overlays/openshift/kustomization.yaml
index 61d803ba..42cf1f00 100644
--- a/deployment/overlays/openshift/kustomization.yaml
+++ b/deployment/overlays/openshift/kustomization.yaml
@@ -5,32 +5,17 @@ namespace: NAMESPACE_PLACEHOLDER
 
 resources:
   - ../../base
-  - buildconfig.yaml
-  - imagestream.yaml
-  - deployment.yaml
-  - service.yaml
   - route.yaml
   - pdb.yaml
   - hpa.yaml
-
-components:
-  - ../../components/postgres
-  - ../../components/redis
-
-labels:
-  - pairs:
-      app: agent
-      component: agent
-
-images:
-  - name: agent
-    newTag: latest
+  - opa-deployment.yaml
+  - opa-service.yaml
+  - opa-pdb.yaml
+  - opa-policies-configmap.yaml
+  - opa-configmap.yaml
+  - opa-secret.yaml
 
 patches:
-  - path: configmap-patch.yaml
-  - path: secret-patch.yaml
-
-  # Agent deployment patches
   - target:
       kind: Deployment
       name: agent
@@ -48,74 +33,29 @@ patches:
         path: /spec/template/spec/containers/0/resources/limits/cpu
         value: "1000m"
 
-  # PostgreSQL deployment patches (from base)
+  # OPA resource limits
   - target:
       kind: Deployment
-      name: postgres
+      name: opa
     patch: |-
       - op: replace
         path: /spec/template/spec/containers/0/resources/requests/memory
-        value: "512Mi"
+        value: "128Mi"
       - op: replace
         path: /spec/template/spec/containers/0/resources/requests/cpu
-        value: "200m"
+        value: "100m"
       - op: replace
         path: /spec/template/spec/containers/0/resources/limits/memory
-        value: "1Gi"
-      - op: replace
-        path: /spec/template/spec/containers/0/resources/limits/cpu
-        value: "1000m"
-      - op: add
-        path: /spec/template/spec/containers/0/args
-        value: ["-c", "max_connections=200"]
-
-  # PostgreSQL PVC size (OpenShift gets more storage)
-  - target:
-      kind: PersistentVolumeClaim
-      name: postgres-pvc
-    patch: |-
-      - op: replace
-        path: /spec/resources/requests/storage
-        value: "10Gi"
-
-  # Redis deployment patches (from base)
-  - target:
-      kind: Deployment
-      name: redis
-    patch: |-
-      - op: replace
-        path: /spec/template/spec/containers/0/resources/requests/memory
         value: "256Mi"
-      - op: replace
-        path: /spec/template/spec/containers/0/resources/limits/memory
-        value: "512Mi"
       - op: replace
         path: /spec/template/spec/containers/0/resources/limits/cpu
         value: "500m"
 
-  # Redis PVC size (OpenShift gets more storage)
+  # Add OPA_URL to agent config
   - target:
-      kind: PersistentVolumeClaim
-      name: redis-pvc
+      kind: ConfigMap
+      name: agent-config
     patch: |-
-      - op: replace
-        path: /spec/resources/requests/storage
-        value: "2Gi"
-
-  # BuildConfig patches
-  - target:
-      kind: BuildConfig
-      name: agent
-    patch: |-
-      - op: replace
-        path: /spec/resources/requests/memory
-        value: "2Gi"
-      - op: replace
-        path: /spec/resources/requests/cpu
-        value: "1000m"
-      - op: replace
-        path: /spec/resources/limits/memory
-        value: "4Gi"
-      - op: replace
-        path: /spec/resources/limits/cpu
-        value: "4"
+      - op: add
+        path: /data/OPA_URL
+        value: "http://opa:8181/v1/data/agent/authz"
diff --git a/deployment/overlays/openshift/opa-configmap.yaml b/deployment/overlays/openshift/opa-configmap.yaml
new file mode 100644
index 00000000..52dd859d
--- /dev/null
+++ b/deployment/overlays/openshift/opa-configmap.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: opa-config
+data:
+  OPA_POLICY_GIT_REPO: ""
+  OPA_POLICY_GIT_BRANCH: "main"
+  OPA_POLICY_GIT_SUBDIR: ""
+  OPA_POLICY_GIT_SSL_VERIFY: "true"
+  OPA_POLL_INTERVAL: "30"
diff --git a/deployment/overlays/openshift/opa-deployment.yaml b/deployment/overlays/openshift/opa-deployment.yaml
new file mode 100644
index 00000000..26f46dba
--- /dev/null
+++ b/deployment/overlays/openshift/opa-deployment.yaml
@@ -0,0 +1,135 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opa
+  labels:
+    component: opa
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      component: opa
+  template:
+    metadata:
+      labels:
+        component: opa
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    component: opa
+                topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: ScheduleAnyway
+          labelSelector:
+            matchLabels:
+              component: opa
+      containers:
+        - name: opa
+          image: ghcr.io/redhat-data-and-ai/template-agent-opa:latest
+          ports:
+            - containerPort: 8181
+              name: http
+              protocol: TCP
+          env:
+            - name: OPA_POLICY_GIT_REPO
+              valueFrom:
+                configMapKeyRef:
+                  name: opa-config
+                  key: OPA_POLICY_GIT_REPO
+            - name: OPA_POLICY_GIT_BRANCH
+              valueFrom:
+                configMapKeyRef:
+                  name: opa-config
+                  key: OPA_POLICY_GIT_BRANCH
+            - name: OPA_POLICY_GIT_SUBDIR
+              valueFrom:
+                configMapKeyRef:
+                  name: opa-config
+                  key: OPA_POLICY_GIT_SUBDIR
+            - name: OPA_POLICY_GIT_SSL_VERIFY
+              valueFrom:
+                configMapKeyRef:
+                  name: opa-config
+                  key: OPA_POLICY_GIT_SSL_VERIFY
+            - name: OPA_POLL_INTERVAL
+              valueFrom:
+                configMapKeyRef:
+                  name: opa-config
+                  key: OPA_POLL_INTERVAL
+            - name: OPA_POLICY_GIT_AUTH_USER
+              valueFrom:
+                secretKeyRef:
+                  name: opa-secrets
+                  key: OPA_POLICY_GIT_AUTH_USER
+            - name: OPA_POLICY_GIT_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: opa-secrets
+                  key: OPA_POLICY_GIT_AUTH_TOKEN
+          startupProbe:
+            exec:
+              command:
+                - /usr/local/bin/opa
+                - eval
+                - "true"
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 6
+          livenessProbe:
+            exec:
+              command:
+                - /usr/local/bin/opa
+                - eval
+                - "true"
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - /usr/local/bin/opa
+                - eval
+                - "true"
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          lifecycle:
+            preStop:
+              exec:
+                command:
+                  - sleep
+                  - "5"
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "200m"
+          volumeMounts:
+            - name: opa-policies
+              mountPath: /policies
+              readOnly: true
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - name: opa-policies
+          configMap:
+            name: opa-policies
+      restartPolicy: Always
diff --git a/deployment/overlays/openshift/opa-pdb.yaml b/deployment/overlays/openshift/opa-pdb.yaml
new file mode 100644
index 00000000..97c5f2a9
--- /dev/null
+++ b/deployment/overlays/openshift/opa-pdb.yaml
@@ -0,0 +1,11 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: opa
+  labels:
+    component: opa
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      component: opa
diff --git a/deployment/overlays/openshift/opa-policies-configmap.yaml b/deployment/overlays/openshift/opa-policies-configmap.yaml
new file mode 100644
index 00000000..d4b8bc6e
--- /dev/null
+++ b/deployment/overlays/openshift/opa-policies-configmap.yaml
@@ -0,0 +1,82 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: opa-policies
+data:
+  agent_authz.rego: |
+    package agent.authz
+
+    # Agent Authorization Policy - Local Development Placeholder
+    #
+    # This file is intentionally minimal. Production policies are loaded from
+    # the git repository and will completely control authorization behavior.
+    #
+    # Do not add allow/deny rules here to avoid conflicts with git policies.
+    # Local trajectory overrides live in trajectory_limits.rego (local cap 10 vs git 20).
+
+    import rego.v1
+  message_policies.rego: |
+    package agent.authz
+
+    import rego.v1
+
+    # Additional banned words for local development.
+    # Git policy banned-words.rego defines base banned_words and allow rules;
+    # this file extends the same package without redefining banned_words (OPA conflict).
+    # Git allow/deny rules automatically pick up these supplementary checks via
+    # shared rule names (contains_banned_word_in_agent_message, etc.).
+
+    additional_banned_words := {
+    	"prescription",
+    	"nurse",
+    }
+
+    contains_banned_word_in_agent_message if {
+    	input.current_intent.action == "llm_response"
+    	agent_msg := lower(input.current_intent.agent_message)
+    	word := additional_banned_words[_]
+    	contains(agent_msg, lower(word))
+    }
+
+    contains_banned_word_in_tool_result if {
+    	input.current_intent.action == "tool_response"
+    	tool_result := lower(input.current_intent.result)
+    	word := additional_banned_words[_]
+    	contains(tool_result, lower(word))
+    }
+
+    deny_reasons contains msg if {
+    	input.current_intent.action == "llm_response"
+    	agent_msg := lower(input.current_intent.agent_message)
+    	word := additional_banned_words[_]
+    	contains(agent_msg, lower(word))
+    	msg := sprintf("Banned word '%s' found in agent response", [word])
+    }
+
+    deny_reasons contains msg if {
+    	input.current_intent.action == "tool_response"
+    	tool_result := lower(input.current_intent.result)
+    	word := additional_banned_words[_]
+    	contains(tool_result, lower(word))
+    	msg := sprintf("Banned word '%s' found in tool result", [word])
+    }
+  trajectory_policies.rego: |
+    package agent.authz
+
+    import rego.v1
+
+    # Local trajectory limits for development.
+    # Git trajectory policy defines max_trajectory_length := 20; this file sets a
+    # different local cap via local_max_trajectory_length to avoid OPA complete-rule
+    # conflict when both policy sources are loaded.
+
+    local_max_trajectory_length := 20
+
+    deny_reasons contains msg if {
+    	input.current_intent.action == "trajectory_validation"
+    	count(input.trajectory) > local_max_trajectory_length
+    	msg := sprintf(
+    		"Local trajectory length (%d) exceeds limit (%d)",
+    		[count(input.trajectory), local_max_trajectory_length],
+    	)
+    }
diff --git a/deployment/overlays/openshift/opa-secret.yaml b/deployment/overlays/openshift/opa-secret.yaml
new file mode 100644
index 00000000..90d3a3b0
--- /dev/null
+++ b/deployment/overlays/openshift/opa-secret.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: opa-secrets
+type: Opaque
+stringData:
+  OPA_POLICY_GIT_AUTH_USER: ""
+  OPA_POLICY_GIT_AUTH_TOKEN: ""
diff --git a/deployment/overlays/kind/service.yaml b/deployment/overlays/openshift/opa-service.yaml
similarity index 50%
rename from deployment/overlays/kind/service.yaml
rename to deployment/overlays/openshift/opa-service.yaml
index 5d29b2b4..f7bc8db8 100644
--- a/deployment/overlays/kind/service.yaml
+++ b/deployment/overlays/openshift/opa-service.yaml
@@ -1,17 +1,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: agent
+  name: opa
   labels:
-    app: agent
-    component: agent
+    component: opa
 spec:
-  selector:
-    app: agent
-    component: agent
+  type: ClusterIP
   ports:
-    - port: 5002
-      targetPort: 5002
+    - port: 8181
+      targetPort: 8181
       protocol: TCP
       name: http
-  type: ClusterIP
+  selector:
+    component: opa
diff --git a/deployment/overlays/openshift/redis-patch.yaml b/deployment/overlays/openshift/redis-patch.yaml
deleted file mode 100644
index f46dd078..00000000
--- a/deployment/overlays/openshift/redis-patch.yaml
+++ /dev/null
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: redis
-$patch: merge
-spec:
-  selector:
-    app: agent
-    component: cache
diff --git a/deployment/overlays/openshift/route.yaml b/deployment/overlays/openshift/route.yaml
index 4f4480ff..ed76318f 100644
--- a/deployment/overlays/openshift/route.yaml
+++ b/deployment/overlays/openshift/route.yaml
@@ -8,11 +8,13 @@ metadata:
     shard: internal
   annotations:
     haproxy.router.openshift.io/timeout: 18000s
-    haproxy.router.openshift.io/balance: roundrobin
+    haproxy.router.openshift.io/balance: leastconn
     haproxy.router.openshift.io/rate-limit-connections: "true"
     haproxy.router.openshift.io/rate-limit-connections.concurrent-tcp: "100"
     haproxy.router.openshift.io/rate-limit-connections.rate-http: "1000"
     haproxy.router.openshift.io/rate-limit-connections.rate-tcp: "1000"
+    haproxy.router.openshift.io/hsts_header: max-age=31536000;includeSubDomains
+    haproxy.router.openshift.io/enable-websocket: "true"
 spec:
   to:
     kind: Service
diff --git a/deployment/overlays/openshift/secret-patch.yaml b/deployment/overlays/openshift/secret-patch.yaml
deleted file mode 100644
index 6bed01a3..00000000
--- a/deployment/overlays/openshift/secret-patch.yaml
+++ /dev/null
@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: agent-secrets
-type: Opaque
-stringData:
-  SSL_KEYFILE: ""
-  SSL_CERTFILE: ""