Constrain data paths
Policies filter configured provider/model routes before a credential is decrypted or request is sent.
For CISOs
Make AI traffic governable before it becomes an incident trail.
Centralize credentials, enforce model boundaries, integrate OIDC identity, and retain metadata-only policy evidence.
Fail-closed authorization and tenant isolation
OIDC, built-in RBAC, virtual workload keys, and risk-aware policy
Metadata-only audit and policy-decision events
In plain language
Put an enforceable control point in front of approved model traffic.
The gateway does not eliminate shadow AI by itself. It gives approved applications and agents a safer path: centralized provider credentials, workload identity, model and data-class policy, local attack signals, budget limits, and reason-coded evidence.
The security outcomeSecurity can narrow data paths and revoke workload access without becoming the manual approval queue for every ordinary request.
For the operating team
Separate preventive controls from detection and response.
Preventive controls act locally before provider forwarding. Metadata-only administrative events can leave through signed generic HTTPS delivery; native SIEM, DLP, ticketing, and lifecycle adapters retain explicit availability labels.
What administrators configure
Access boundary
Require tenant, workload, environment, client mode, and user context before any route is considered.
Request and response guardrails
Evaluate built-in attack, secret, and PII signals plus organization-specific RE2 formats in Observe or Enforce mode; redact or block response matches without retaining payloads.
Support boundary
Use a distinct staff identity plane and customer-authorized, time-bounded support access.
Security delivery
Send HMAC-signed administrative event metadata to up to five customer-owned HTTPS receivers with at-least-once retries, evidence, and replay—without exporting prompts, responses, secrets, snapshots, or tool payloads.
What happens to each request
- 01Identify
Bind the request to an organization, workload, environment, user, and declared execution context.
- 02Evaluate
Apply policy and local attack signals before any provider credential is decrypted.
- 03Act
Allow, deny, cap, reroute, or observe the request with a stable reason code.
- 04Evidence
Write authorized metadata for review without persisting prompt or response bodies by default.
See the working control
Troubleshoot from the decision, not from a prompt archive.
The live ledger shows workload, route, reason code, upstream attempt, outcome, latency, configured cost, and audit-chain integrity.
- Rendered by the real customer console and control API
- Exercised with safe OpenAI- and Anthropic-compatible simulators
- Sanitization gate rejects credential-shaped values and private owner email
The live ledger shows workload, route, reason code, upstream attempt, outcome, latency, configured cost, and audit-chain integrity.
Control surface
Useful on day one. Explainable on day one hundred.
Each control has an operating path, an owner, and evidence that can be reviewed without collecting prompt bodies by default.
Minimize collected data
Prompt and response bodies are not retained by default; telemetry settings are explicit.
Build the evidence now
Control mappings support later SOC 2, HIPAA, and regulated-customer reviews without inventing unsupported claims today.
Evidence, not assertions
Retain the decision trail, minimize the content footprint.
Security reviewers can inspect identity, policy, route, timing, cost, and outcome metadata while prompt persistence remains off by default.
Review security boundaries and current status- Reason-coded policy, route, retry, fallback, and denial metadata
- Bounded tool names, types, MCP hosts, and authorization outcomes—without schemas, arguments, or results
- Provider-reported usage reconciliation for complete responses and supported terminal streams
- Tenant-bound credential encryption and fail-closed tenant authorization
- Signed, retryable administrative audit delivery with payloads and configuration snapshots excluded
- Clear labels separating available controls from items that still require validation
Questions teams ask
Know the boundary before you deploy.
Clear answers for buyers, administrators, and security reviewers.
Does the gateway detect jailbreak attempts?
The current runtime includes configurable local pre-forward attack signals, tenant-defined bounded patterns, and Observe or Enforce modes. Response controls can detect, redact, or block built-in secret and PII formats plus organization-specific formats. These layers complement—not replace—provider safety controls and application validation.
Can staff impersonate a customer administrator?
Customer and staff identity pools are separate. Support access is designed to require explicit, time-bounded authorization rather than routine customer impersonation.
Has the service completed an external penetration test?
Not yet. Automated security gates and AWS perimeter controls are implemented baselines, but independent penetration testing remains a production assurance gap.
Can changes be sent to our SIEM?
A generic signed HTTPS audit webhook is implemented for administrative event metadata. Native Splunk HEC, Sentinel, Chronicle, Datadog, object-storage, and syslog adapters are not currently included; do not treat the generic receiver as native integration certification.
Start safely
Start guided setupSee what the policy would do before it can block production.
Connect a provider credential, create a workload key, and begin in Observe mode. Move a tested rule to Enforce when your team is ready.