AIOGen is a compiled Kubernetes admission engine: policy logic runs as native code inside the engine. Kyverno is a widely-used DSL engine that interprets declarative YAML policy rules at request time. That single architectural difference predicts everything below — a compiled engine should stay flat as you add policies, while an interpreter should scale linearly. In this run, the data matches the theory.
The three latency layers
Admission latency is best read as three nested circles. Isolating them keeps the comparison honest — it separates the policy logic itself from the engine around it, and from the network everyone pays.
The inner circle is the story in miniature: an interpreted rule costs roughly 2.5 ms each, so fifty of them is ~125 ms of pure logic. AIOGen’s compiled symbols cost a fraction of a millisecond each, so the same fifty barely move the needle. That is the difference between a curve that climbs and one that stays flat.
Latency vs. policy count
This is the decisive picture. As policies are added, Kyverno’s interpreter adds ~2.35 ms of median latency per policy; AIOGen stays essentially flat. Because one line climbs and the other doesn’t, the advantage isn’t a fixed multiplier — it compounds with scale.
| Policies | Kyverno median | AIOGen median | End-to-end speedup |
|---|---|---|---|
| 10 | 34 ms | 2.2 ms | ~15× |
| 19 | 49 ms | 3.1 ms | ~16× |
| 25 | 64 ms | 3.7 ms | ~17× |
| 40 | 101 ms | 6.5 ms | ~16× |
| 50 | 128 ms | 8.2 ms | ~16× |
Why latency is a cost, not just a delay
Admission runs on the write path of every workload: each pod creation waits for the policy verdict. Every additional millisecond there is compute time spent evaluating requests and holding resources. In a busy cluster, higher admission latency compounds into more CPU, more memory pressure, more replicas to hold throughput — and a larger bill for the same governance outcome. A governance layer that behaves like efficient infrastructure, rather than recurring overhead, is simply easier to justify — especially at the edge, where every core is scarce.
Methodology
We publish the test profile so the claim is anchored to a defined workload and a disclosed reference version.
| Item | Details |
|---|---|
| Load generator | k6, concurrent direct — 100 virtual users, 1000 requests |
| Path | Allow path: a fully-compliant pod exercising the entire policy chain |
| Environment | Same single-node 16-core virtual machine; both engines deployed side by side, without CPU limits |
| Policies | Identical Pod policy set, measured at 10 / 19 / 25 / 40 / 50 policies |
| Kyverno version | v1.18.1 (self-deployed on the same host) |
| Inner-circle metric | Pure policy-logic latency (per rule / per symbol) |
| Outer-circle metric | Full engine-handler latency (each engine’s own admission histogram) |
| End-to-end metric | k6 http_req_duration median (client round-trip) |
Founder’s note
We share these results to show where AIOGen stands today, not to suggest the journey is finished. The earlier checkpoint compared us against a published benchmark on a different environment; this one puts both engines on the same box under the same load, which we believe is the fairer test. The result we care about most isn’t a single multiplier — it’s the shape of the curve. A compiled engine that stays flat as governance grows is what makes policy affordable at scale, from cloud to edge. Our focus from here is scale and deployment readiness.
— Founder, Au.AI Software Labs