Features
Built for AI: Secure AI integration with your systems and data. Control access, enforce data governance, and maintain compliance as you adopt AI services. Cloud and on-premises.
Authentication
Connect your identity provider to authenticate users and AI agents.
Human Identityđ¤
Integrate with Active Directory, Okta, AWS IAM, GCP Cloud Identity, Azure Entra ID, LDAP, and other identity providers. Works on desktop and web apps.
Non-Human Identityâī¸
Support AI agent authentication with tokens, X.509 certificates (mTLS), and custom methods.
Enterprise Securityđ
Single sign-on (SSO), group policies, and automated provisioning.
Authorization
Control what AI can access with granular policies. From simple rules to rich custom logic.
Tool Signatures
Verify the integrity and authenticity of AI tools before allowing access to your systems. Cryptographic signatures ensure that only approved, unmodified tools can interact with your data.
Support for multiple verification methods including code signing, hash validation, and custom attestation schemes to maintain a secure AI ecosystem.
Access Control
Authorization policies built for AI interactions. Control access to any system or service while providing rich, contextual responses that help LLMs understand permissions and alternatives.
Before
After
Flexible Policy
Create expressive policies and assign them to groups or individual users to meet your organization's needs.
Target MCP servers, methods, functions, and arguments. Use webhooks to delegate decisions to external systems and third-party CSPM/DSPM solutions, or write fully customizable Lua scripts for advanced logic.
-- Joe the intern lost his laptop on the train todayfunction handler(input) if input.Context.Subject == "joe" and input.Context.MCPServerName == "stocks" then return { Decision = "deny", Details = "Laptop lost, temporary block" } else return { Decision = "defer" } end end
POST https://policy.example.com/authorization/check
{
"type": "request",
"mcp_server_name": "stocks",
"mcp_method": "tools/call",
"subject": "alice",
"function": "purchase_stock",
"arguments": {
"ticker": "TSLA",
"quantity": "100"
},
"body_bytes": "eyJpZCI6MSwibWV0aG9kIjoid..."
}Human-in-the-Loop
Introduce human oversight of AI actions to reduce risk and increase accountability
Approval Workflows
Bring human decisions into your AI systems and tools. Set approval requirements for high-risk or sensitive operations, and route requests to the right people.
Send approval requests to individual users, groups, or escalation hierarchies. Approve via the web interface, Slack, email, or custom integrations.
Data Protection
Detect and protect sensitive information in AI interactions. Alert, redact, tokenize, or filter data to prevent leaks, ensure compliance, and maintain privacy.
Redact Sensitive Information
Mask confidential data while maintaining document structure and analytical value.
Before
After
Tokenize Personally Identifiable Information (PII)
Replace identifiable data with reversible tokens for research and analysis. Available per-session, per-user, per-group, or organization-wide.
Before
After
Block Access to Privileged Information
Completely deny retrieval of critical data. Customize responses to LLMs and users.
Before
After
Network Isolation
Isolate AI systems in secure network environments. Control all inbound and outbound traffic to prevent data exfiltration and credential theft.
Secure Traffic and Boundaries
All traffic flows through the firewall using TLS encryption, with attestation available for confidential compute deployments. Inbound and outbound connections are subject to policy to ensure complete control over data access and prevent unauthorized exfiltration.
Auditing and Observability
Complete visibility into AI activity with detailed logging and request tracing. Export to your monitoring tools for centralized analysis and alerting.
Comprehensive Logs
Structured logging captures every interaction, security event, and activity with complete request tracing across multiple components. Integrate with Splunk, Datadog, Elasticsearch, and other services, or custom endpoints.
Tamper-Proof Deployments
Verify hardware-backed attestations to connect only to authentic, unmodified servers.
Software and Configuration Integrity
Built for handling your most sensitive data or accessing critical systems. Clients cryptographically verify server integrity before connecting to ensure they interact with a trusted runtime environment.
Available in confidential compute deployments, servers generate attestations of their software and configuration state. These are signed with a hardware-rooted chain of trust. Clients decide which combinations are acceptable.
