Control both directions
Policies narrow provider and model routes, screen configured request and response signals, and stop denied traffic before release.
For CISOs
Enforce security policy before AI traffic reaches a provider.
Centralize credentials, identify every workload, screen requests and responses, limit agent tools, stop abusive spend, and retain metadata-focused evidence.
Fail-closed authorization and tenant isolation
OIDC, built-in RBAC, virtual workload keys, and risk-aware policy
Metadata-only audit and policy-decision events
In plain language
Put an enforceable control point in front of approved model traffic.
The gateway does not eliminate shadow AI by itself. It gives approved applications and agents a safer path: centralized provider credentials, workload identity, model and data-class policy, local attack signals, budget limits, and reason-coded evidence.
The security outcomeSecurity can narrow data paths and revoke workload access without becoming the manual approval queue for every ordinary request.
For the operating team
Separate preventive controls from detection and response.
Preventive controls act locally before provider forwarding. Metadata-only administrative events can leave through signed generic HTTPS delivery; native SIEM, DLP, ticketing, and lifecycle adapters retain explicit availability labels.
What administrators configure
Access boundary
Require tenant, workload, environment, client mode, and user context before any route is considered.
Request and response guardrails
Evaluate built-in attack, secret, and PII signals plus organization-specific RE2 formats in Observe or Enforce mode; redact or block response matches without retaining payloads.
Support boundary
Use a distinct staff identity plane and customer-authorized, time-bounded support access.
Security delivery
Send signed administrative event metadata to as many as five customer-owned HTTPS receivers. Delivery supports retries, evidence, and replay. Prompts, responses, secrets, snapshots, and tool payloads stay out of the export.
What happens to each request
- 01Identify
Bind the request to an organization, workload, environment, user, and declared execution context.
- 02Evaluate
Apply policy and local attack signals before any provider credential is decrypted.
- 03Act
Allow, deny, cap, reroute, or observe the request with a stable reason code.
- 04Evidence
Write authorized metadata for review without persisting prompt or response bodies by default.
See the working control
Troubleshoot from the decision, not from a prompt archive for the CISO operating view.
For the CISO operating view, the live ledger shows workload, route, reason code, upstream attempt, outcome, latency, configured cost, and audit-chain integrity.
- This the CISO operating view view runs in the working customer console
- Exercised with safe OpenAI- and Anthropic-compatible simulators
- The the CISO operating view capture excludes keys, prompt text, responses, and private email
For the CISO operating view, the live ledger shows workload, route, reason code, upstream attempt, outcome, latency, configured cost, and audit-chain integrity.
What administrators can change
The settings behind for cisos.
For cisos, the console shows each setting, its owner, and its scope so administrators can review changes before they reach live traffic.
Authorize agents and tools
Workload context, tool declarations, and approved MCP hosts are checked before spend. Prompt and response bodies are not retained by default.
State the assurance boundary
Release evidence and known gaps stay explicit. Automated checks are not presented as a penetration test, certification, or contractual service level.
Evidence, not assertions
Retain the decision trail, minimize the content footprint.
Security reviewers can inspect identity, policy, route, timing, cost, and outcome metadata while prompt persistence remains off by default.
Review security boundaries and current status Use the CISO security checklist Run the 12-test enterprise evaluation- Access boundary: Require tenant, workload, environment, client mode, and user context before any route is considered.
- Request and response guardrails: Evaluate built-in attack, secret, and PII signals plus organization-specific RE2 formats in Observe or Enforce mode; redact or block response matches without retaining payloads.
- Support boundary: Use a distinct staff identity plane and customer-authorized, time-bounded support access.
- Security delivery: Send signed administrative event metadata to as many as five customer-owned HTTPS receivers. Delivery supports retries, evidence, and replay. Prompts, responses, secrets, snapshots, and tool payloads stay out of the export.
Questions teams ask
Questions security teams ask.
What CISOs, security architects, and platform owners need to confirm before approving a gateway.
Does the gateway detect jailbreak attempts?
The current runtime includes configurable local attack signals, tenant-defined patterns, and Observe or Enforce modes. These checks run before forwarding. Response controls can detect, redact, or block common secret and PII formats plus organization-specific formats. These layers add to provider safety controls and application validation; they do not replace them.
Can staff impersonate a customer administrator?
Customer and staff identity pools are separate. Support access is designed to require explicit, time-bounded authorization rather than routine customer impersonation.
Has the service completed an external penetration test?
Not yet. Automated security gates and AWS perimeter controls are implemented baselines, but independent penetration testing remains a production assurance gap.
Can changes be sent to our SIEM?
A generic signed HTTPS audit webhook is implemented for administrative event metadata. Native Splunk HEC, Sentinel, Chronicle, Datadog, object-storage, and syslog adapters are not currently included; do not treat the generic receiver as native integration certification.
Start safely
Start guided setupSee what the policy would do before it can block production.
Start with a provider connection, a limited workload key, and Observe mode; move to enforcement after your team confirms the result.