# Neural Inverse Govern

> Identity, model access, agent policy, approvals and a tamper-evident audit record for every AI tool your engineers use, ours and third-party. Powered by Keystone.

Source: https://neuralinverse.com/govern/

---

![](/photos/team.jpg)

Neural Inverse Govern · Powered by Keystone

# Every AI tool your engineers use, under one set of controls.

Govern decides who may use which model, what agents may do and who must approve it, for Neural Inverse Build and the third-party tools your teams already use. Every decision is recorded.

For

Security, compliance and platform teams

Governs

Neural Inverse Build and third-party AI tools

Sign-in

SAML, OIDC, passkeys and SCIM

Enforced in

Server-side gateways and a signed endpoint policy

Deployment

Self-hosted, your cloud or air-gapped

Overview

Govern is the control plane for the AI models, agents and tools your engineers use. It holds identity and access, decides what each person, agent and tool may do, enforces those decisions in its own gateways, and records every decision in an audit log your auditors can verify.

[Identity ↓](https://neuralinverse.com/#identity)[AI Gateway ↓](https://neuralinverse.com/#ai-gateway)[Agent policy ↓](https://neuralinverse.com/#agent-policy)[Third-party tools ↓](https://neuralinverse.com/#third-party-tools)[Context ↓](https://neuralinverse.com/#context)[Audit and evidence ↓](https://neuralinverse.com/#audit)[Shared services ↓](https://neuralinverse.com/#shared-services)

How Govern is built

## Decisions are made on the server, and fail closed.

One source of policy

The Neural Inverse apps, the endpoint agent and third-party tools read policy from Govern. None of them invents rules.

Enforced on the server

Model requests, MCP tool calls and agent-to-agent calls are decided in Govern's gateways. Checks inside an app are a second line, not the boundary.

Fails closed

An unknown action, an unreadable policy, an expired manifest, an unavailable DLP scan or a failed audit write is a refusal.

Recorded with the change

A change whose audit entry cannot be written does not happen.

[How Govern works](https://neuralinverse.com/docs/govern/)

Identity and access

## Every person and every agent is known.

Access follows your directory. Nobody holds more than they need, and nobody grants access to themselves.

[Identity and access in depth](https://neuralinverse.com/govern/identity/)

- **Single sign-on:** SAML 2.0 and OpenID Connect to your identity provider, tested before a change goes live, with domains you can make SSO-only.
- **Provisioning and leavers:** SCIM 2.0 keeps people and groups current. A deactivation ends sessions, disables keys and revokes every role at once.
- **Least privilege:** Account and resource roles with deny policies, ceilings and separation of duties. Nobody can grant what they do not hold.
- **Temporary and reviewed:** Just-in-time roles with a reason, a fresh second factor and an approver who is not the requester; scheduled access reviews.

AI Gateway

## Approved models only, every request on record.

People, applications and agents reach models through one gateway inside Govern. Provider keys never leave it.

[AI Gateway in depth](https://neuralinverse.com/govern/ai-gateway/)

- **Approved models:** Deny by default, assigned to the organisation, teams or projects, routed by data classification and region.
- **Credentials:** Scoped gateway keys, keyless workload identity, and short-lived tokens for coding tools used by a person.
- **Protection:** DLP on every prompt, organisation guardrails, budgets reserved before a request is sent, and rate limits.
- **Attribution:** Every attempt audited with person, project, model, tokens and cost, without prompt content.

Agent policy and approvals

## Allow, ask or deny. A person decides what matters.

One policy is written in Govern and compiled for each agent engine. The endpoint agent enforces it on the developer's machine.

[Agent policy and approvals in depth](https://neuralinverse.com/govern/agent-policy/)

- **Rules for every action:** Shell commands, files, network, pushes, installs, hooks, MCP tools and models, for the organisation, a team or a project.
- **Strictest rule wins:** Deny beats ask beats allow, and a shell line is split into every command it runs.
- **Named approvers:** An ask can go to named people or teams in one approvals inbox. Nobody approves their own request.
- **Signed delivery:** Policy reaches machines as a signed manifest; once it expires offline, every action is denied.

Third-party AI tools

## Govern the tools your teams already use, as far as each allows.

Govern compiles one policy into each tool's own controls and states plainly how far that reaches. Only an Enforced tool blocks reliably. The levels assume the endpoint agent has installed the compiled policy in the tool's managed location; they were verified against each vendor's mechanism and version in October 2026.

Enforced

A blocking pre-action hook in a managed location the developer cannot remove or disable.

Managed configuration

Govern installs and locks the tool's configuration. Any hook it also runs is advisory.

Network

Holds only while the tool's traffic goes through the Govern model gateway or MCP proxy.

Monitored

Vendor audit or telemetry only. Nothing is blocked.

Not controlled

Govern has no control. Listed so administrators see the gap.

| Tool | Control level |
| --- | --- |
| Claude Code | Enforced |
| Cursor | Enforced |
| Windsurf | Enforced |
| GitHub Copilot CLI | Enforced |
| Codex | In verification |
| Gemini CLI | Managed configuration |
| Kiro CLI | Monitored |
| Cline | Monitored |
| Amazon Q Developer | Monitored |
| Continue | Not controlled |

Claude Code, Codex, Aider, Continue, Cline and Roo Code can also send their model requests through the Govern AI Gateway, so model access, budgets, DLP and guardrails apply to them (Network). Cursor does so only for custom models. Without an egress lock on developer machines, a person can bypass the gateway with another key or endpoint.

Product names belong to their owners.

[What each tool covers, and what it does not](https://neuralinverse.com/govern/third-party-tools/)

Context for agents

## Agents work from approved knowledge only.

Teams decide which sources agents may draw on. Govern checks access on every retrieval and records what was used.

[Context for agents in depth](https://neuralinverse.com/govern/context/)

- **Approved sources:** Spaces of GitHub code and issues and team knowledge that follow your organisation, served to editors, agents and MCP clients.
- **Access on every retrieval:** Each space is authorised for the person asking, and DLP is applied by classification, before anything is returned.
- **Attribution:** Which pieces of context fed a request, and which model call used them, in a hash-chained evidence record.
- **Shared with control:** Lenses, handoffs, team memory and agent instruction files, under a collaboration policy that lower levels can only tighten.

Audit and evidence

## A record your auditors can check without trusting us.

Who did what, with which tool, under which rule and with whose approval, kept in one append-only log.

[Audit and evidence in depth](https://neuralinverse.com/govern/audit/)

- **Written with the change:** If the audit entry cannot be written, the change does not happen.
- **Hash-chained and signed:** A chain per organisation, sealed and signed every minute, verifiable offline with a standalone verifier.
- **Retention tiers:** Older entries move to your own bucket as signed segments, under Object Lock where you choose. Govern has no operation that deletes them.
- **Evidence and vendor records:** Evidence toward your frameworks, and the audit records of third-party AI vendors beside Govern's own.

Shared services

## Services under both products.

Secrets, keys, DLP, gateways for tools and agents, sandboxes, the console assistant and harness packs, held to the same rules.

[Shared services in depth](https://neuralinverse.com/govern/shared-services/)

- **Vault and keys:** Write-only secrets, dynamic credentials, and per-organisation keys for envelope encryption.
- **MCP and agent gateways:** A reviewed catalog of MCP servers and allow rules for remote agents, with DLP and call approvals.
- **Sandboxes:** Isolated runtimes for agent work, with templates, policy, per-member quotas and approved artifacts.
- **Console assistant and harness packs:** An assistant that acts only as the signed-in person, and signed developer-experience packs for the Editor.

How a request moves through Govern

## Checked, approved where it matters, and recorded.

Shown for a model request. Agent actions and MCP tool calls are identified, decided, approved and recorded the same way.

1.  Identify
    
    Govern establishes who is asking: a person, an agent, a gateway key or a workload, from a short-lived credential.
    
2.  Decide
    
    Policy for that person or agent is applied: approved models, the project's classification, agent rules and deny rules.
    
3.  Protect
    
    DLP and guardrails check the content; budgets and rate limits are reserved before anything is sent.
    
4.  Approve
    
    An action that needs a person waits for a named approver who is not the requester.
    
5.  Record
    
    The decision, the rule behind it and any approval are written to the hash-chained audit log.
    

![](/photos/facility.jpg)

Where it runs

## Deploy it where your data has to stay.

[Deployment options](https://neuralinverse.com/deployment/)

- **Self-hosted:** On your own servers, with Docker Compose or Kubernetes.
- **In your cloud:** On your Kubernetes cluster in your own cloud account.
- **Air-gapped:** From an offline bundle, on a network with no internet access.
- **Hosted by us:** We run it for you, with the same controls and audit record.

Works with Neural Inverse Build

Give engineers AI that follows your rules from the first keystroke.

Build's Editor, Agents and CLI sign in with Govern, use models through its gateway and record their activity in its audit log.

[Explore Build](https://neuralinverse.com/build/)

![](/photos/team.jpg)

## Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

[Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)