Enforce AI policy in the request path. Prove every decision.

Shadow AI usage

Any team can call any model provider, enable any tool, or connect any MCP server — with no central record.

No audit trail

When compliance asks who used AI, for what, and at what cost, there is no answer to give them.

Policy without enforcement

Approved-model lists live in a wiki. Nothing in the request path actually stops a violation.

Authenticate

Clients hold virtual keys. Real provider credentials never leave the gateway.

Enforce policy

Providers, models, tools, MCP servers, input size, and budgets are evaluated per request.

Forward or block

Allowed requests pass through unmodified. Denied requests fail before a token is spent.

Audit

Every request is written to an immutable trail, priced, and attributed by activity.

Deploy in your infrastructure

The gateway is a single static binary with a Docker Compose quick start. For production, the shipped Helm chart runs it highly available on Kubernetes — budget and rate-limit counters are shared across replicas through Postgres, and separate liveness and readiness probes keep rolling updates safe.

Point your applications at it

Clients keep calling the standard OpenAI and Anthropic API paths. Adoption is a base-URL change plus a virtual key — no SDK swap, no application rewrite, and streaming responses pass straight through.

Bind teams to policy

Each client key or directory group maps to a named policy — or starts from a shipped compliance pack. Policy is plain YAML with secrets referenced by environment variable, so it is reviewable, versionable, and safe to commit.

Credentials never reach clients

Real provider keys are referenced by environment variable, resolved at startup, and injected only at the moment a request is forwarded. The config file never contains a secret, and clients only ever hold revocable virtual keys.

Access is managed in your directory

Users authenticate with JWTs from Entra ID, Okta, Google Workspace, or ADFS. Directory groups map to policies — fail closed — and every audit record carries the actual user, not just a key. Service accounts keep virtual keys.

Fail closed is the architecture

Anything the gateway cannot authenticate, parse, route, or that policy does not explicitly permit is rejected before a token is spent. An unknown policy is a deny, not an error.

The record is complete, wherever a request stops

Allowed, denied, over budget, or rejected at the front door — every terminal path writes exactly one audit record. There is no code path that skips the trail.

Policy engine

Allow/deny rules over providers, models, tools, and MCP servers — per team. Deny always wins; default-deny allow-lists.

Evidence-required assurance

Regulated deployments can refuse new AI and MCP work when the durable evidence sink is unhealthy, then recover automatically when the store is available again.

Usage, cost & budgets

Cache-aware provider pricing, reasoning-token visibility, proactive budget warnings, and hard daily or monthly caps enforced inline.

Two-sided MCP threat scanning

Tool arguments are scanned before execution; untrusted tool results are scanned before they re-enter agent context, with content-free findings written to evidence.

Secrets, PII & model-based NER

Deterministic credential and identifier detection combines with an optional model tier for names, addresses, dates of birth, medical narratives, and other unstructured data.

Prompt registry & quality

Versioned, policy-gated templates with typed variables, static lint scores, and runtime quality metrics.

Policy-safe provider failover

A pre-authorized backup can handle an unreachable, 5xx, or rate-limited primary only when the same policy and data-protection checks approve it.

Signed evidence bundles

One repeatable database snapshot is cross-checked against its read model, canonically serialized, and optionally signed with Ed25519 for offline verification.

Identity lifecycle with SCIM

Entra ID, Okta, Google Workspace, and ADFS identities map to policy; SCIM 2.0 deactivation suspends every principal key derived for that user.

Cloud-app governance (CASB)

An approved-app catalog enforced by an inline forward proxy and decision API, with a shadow-IT discovery feed for what is not yet catalogued.

Proactive alerting

Webhook notifications to Slack, Teams, or a generic endpoint on budget breaches, denial spikes, and sensitive-data blocks — with per-rule cooldowns.

Per-user budgets & rate limits

An optional cap per key or user on top of the policy budget, plus token-bucket rate limits — over-limit requests get 429 before any upstream call.

Endpoint & device governance

Managed machines enroll once through the aops-agent binary and heartbeat on a scoped, one-time device credential — rotate or retire any endpoint from the operator UI without touching the team's virtual key.

Control-plane approvals

MCP servers and skills are cataloged and reviewed through a transactional approval workflow before they're discoverable; a caller still only sees skills its own policy explicitly allows.

MCP supply-chain advisories

Each declared MCP implementation package can be checked against a reviewed local OSV artifact without live dependency resolution or runtime package installation.

Least-privilege remit report

Compare policy-declared models, providers, tools, and MCP servers with observed use to surface unused access, denied attempts, and policy drift.

Bring your own database

The audit trail, budgets, and approvals persist to PostgreSQL you control — AWS RDS, Azure, Google Cloud SQL, on-prem, or Kubernetes — with engine-neutral configuration and versioned migrations.

Endpoint release assurance (pilot)

Stage only pinned, signed, hash-verified endpoint artifacts; reject rollback before a fixed-purpose updater can act, and retain content-minimized lifecycle evidence.

Governed skill execution (gated)

Tenant-owned publisher, approval, readiness, and capability evidence can issue exact short-lived grants and canonical run receipts; native capability evaluation and production execution proof still gate activation.

Bounded-memory audit verification

Verify JSONL and database chains through fixed-size readers and row streams so peak memory stays bounded as evidence grows, without changing verification results.

AI Governance Score

Turn policy, provider, and platform checks into a 0-1000 posture score with prioritized remediation and framework references.

Alert center & response automation

Coalesce governance events into an operational queue, then approve or pre-authorize playbooks that notify, suspend a key, or change policy.

Shadow AI & threat intelligence

Detect provider traffic that bypasses the gateway, import existing proxy logs, and correlate new host or model indicators against prior activity.

Executive reporting

Produce scheduled governance reports, top-offender views, and a single pass/warn/fail sweep for leadership, auditors, or CI.

Multi-tenant administration

Scope usage, alerts, reports, identities, and governance views by organization for business units, regulated subsidiaries, or managed services.

Guardrail observability

Track posture drift, review sampled AI usage for nuanced policy evasion, and flag risky configuration changes before they merge.

Agent memory governance

Apply policy to durable agent memory operations, preserve attribution, and keep memory-related threat findings in the same evidence and response workflows.

How a request is judged

Every request runs the same ordered gates. Deny always wins, and each allow-list is default-deny — anything not explicitly permitted is rejected.

Self-hosted by design

The gateway, policy, and audit trail run inside your infrastructure. Provider credentials never reach clients, and request content is sent only to the provider or MCP server that policy approved.

HIPAA

Restrictive-by-default baseline for protected health information — provider and model allow-lists scoped to your BAA, PHI detection that blocks on match, and minimum-necessary limits on prompt templates and input size.

GDPR

Baseline for personal data of EU/EEA subjects — provider and model allow-lists pinned to adequacy- or SCC-covered endpoints, with detection set to flag rather than block so lawful-basis processing isn't rejected outright.

FINRA / GLBA / PCI-DSS

Baseline for nonpublic personal information and cardholder data — Luhn-validated card detection, vendor-scoped provider allow-lists, and an optional full-transcript mode for books-and-records retention.

Also mapped: SOC 2

SOC 2 is a control mapping rather than a policy pack. Virtual keys and policy scoping support logical access; the audit trail and denial reason codes support monitoring; and config-as-code — reviewable YAML with every secret referenced by environment variable, never written in the file — supports change management.

Data protection scanning

Pattern-based detection on request input, reported by kind and count only — the matched value itself is never logged or stored anywhere.

Evidence, on demand

Every request — allowed or denied — writes one audit record: who made it, which policy applied, the disposition and matched rule, PII flags, and latency.

Scanning the response, too

Input scanning stops sensitive data going to a provider. Response scanning catches it coming back — PHI the model was given elsewhere and echoed, or a generated value that looks real.

Tamper evidence you can prove

Every record is SHA-256 hash-chained to its predecessor, so inserting, deleting, reordering, or editing a committed record forces recomputing every hash after it — and is detectable.

Substantial functional MVP

Provider and MCP proxying, streaming, policy, identity, budgets, scanning, transcripts, and tamper-evident audit evidence are implemented and under active pre-1.0 validation.

Governance operations

Posture scoring, alerts, response automation, threat intelligence, executive reports, multi-tenancy, and guardrail observability are implemented.

Prompt governance

Versioned templates, quality metrics, LLM-as-judge review, content-hash-bound approvals, and approval-gated rendering are implemented.

Hosted administration

OIDC authorization-code sign-in with PKCE, tenant-scoped RBAC, and short-lived Postgres-backed browser sessions are implemented.

Deployment baseline

Docker Compose, Kubernetes and Helm, shared Postgres counters, health/readiness probes, concurrent migration safety, and a Coolify staging profile are available.

Execution & portability hardening

The skill-execution control plane and sandbox substrate are delivered as a fail-closed boundary; native capability evaluation, complete adapter parity, provider certification, end-user apps, external anchoring, and broader production proof remain.