# Platform teams · Solutions > For developer platform and IT teams who install, connect and operate the tools engineers use. Govern runs as one server binary with PostgreSQL. Source: https://neuralinverse.com/solutions/platform-teams/ --- ![](/photos/hangar.jpg) [Solutions / Developer platform and IT](https://neuralinverse.com/solutions/) # Roll out AI tools once, and run them on infrastructure you control. For developer platform and IT teams who install, connect and operate the tools engineers use. Govern runs as one server binary with PostgreSQL. For Developer platform and IT Server One binary and PostgreSQL Install Docker Compose or Kubernetes with Helm Managed policy Windows, macOS and Linux Deployment Self-hosted, your cloud or air-gapped What you own ## What a platform team runs. - **Rollout to every machine:** Installers, settings and the address of your deployment on every developer machine, on three operating systems. - **Joiners and leavers:** People arrive and leave through the identity provider, and every tool has to follow without manual accounts. - **Model providers:** Connecting hosted and self-hosted models, keeping their keys, and giving each team the models it is allowed. - **Applications and pipelines:** Services and CI jobs that call models need credentials that never end up in a repository. - **The service itself:** Database, upgrades, backups and monitoring, sometimes on networks with no internet access. What Neural Inverse gives you ## Built to be operated by your team. Each row is a capability of Neural Inverse Build or Govern in use today. - **Managed policy for the apps:** Group Policy templates on Windows, a configuration profile on macOS and a JSON policy file on Linux set the deployment address and audit settings. The CLI's managed settings file locks every key it sets. - **Single sign-on and SCIM:** SAML 2.0 and OpenID Connect with presets for Microsoft Entra ID, Okta, Google Workspace and Ping Identity; SCIM 2.0 with identity provider groups mapped to roles. Machines without a browser sign in with a device code. - **One gateway for every provider:** Anthropic, OpenAI, Google, Azure OpenAI, Amazon Bedrock, Vertex AI and self-hosted servers behind OpenAI- and Anthropic-compatible endpoints, so existing SDKs work by changing the base URL. - **Routing and reliability:** Retries with backoff, a circuit breaker per model, fallback chains and routing strategies. A fallback never reaches a model the caller could not use directly. - **Keys for workloads:** Gateway keys scoped to the organisation, a team, a project or a person, with rotation and expiry. Keyless workload identity exchanges a Kubernetes or CI token for a key that lives at most an hour. - **Policy on every machine:** The endpoint agent fetches a fresh signed manifest every five minutes while online and installs each engine's compiled files where the tool reads them. - **Deploy your way:** Docker Compose for one host, Kubernetes with Helm for production, or an offline bundle for networks with no internet access. Govern never runs as the PostgreSQL superuser. Hosted by us is also available. How a change moves ## How an agent action moves on a managed machine. 1. Install Managed policy installs the apps and points them at your Govern deployment. 2. Sign Govern compiles the policy for each engine and signs the manifest. 3. Enforce The endpoint agent verifies the manifest and decides every action on the machine. 4. Approve An ask with named approvers waits for one of them in the approvals inbox, never the requester. 5. Record The decision, the rule behind it and the approval go to the hash-chained audit log. For your auditor ## What you can show an auditor. Configuration changes are recorded the same way as everything else. - **Every configuration change:** Changes to roles, settings, policy, hooks and connections, written in the same transaction as the change. If the entry cannot be written, the change fails. - **Sign-ins and provisioning:** Every single sign-on attempt with its reason, and every SCIM change, with provisioning status that shows the last operations. - **Model usage:** Usage events, per-key analytics, model usage and provider health. - **Offline verification:** A standalone verifier checks exported chains and archived segments with no network access and no connection to Govern, using the public keys of your installation. Neural Inverse provides evidence toward the standards you report against. Certification stays with your organisation and assessor. Read next [Deployment options → Self-hosted, your cloud, air-gapped or hosted by us.](https://neuralinverse.com/deployment/)[Identity and access → Single sign-on, SCIM, roles and just-in-time access.](https://neuralinverse.com/govern/identity/)[AI Gateway → Providers, routing, keys and workload identity.](https://neuralinverse.com/govern/ai-gateway/)[Neural Inverse Build → The Editor, the Agents app and the CLI, governed by your organisation's signed policy.](https://neuralinverse.com/build/) Industries[Industrial automation](https://neuralinverse.com/industries/industrial/)[Banking and mainframe](https://neuralinverse.com/industries/banking/)[Telecommunications](https://neuralinverse.com/industries/telecom/) Documentation[Deploy and operate](https://neuralinverse.com/docs/deploy/)[Kubernetes](https://neuralinverse.com/docs/deploy/kubernetes/)[SCIM](https://neuralinverse.com/docs/govern/scim/)[Gateway keys and workload identity](https://neuralinverse.com/docs/govern/gateway-keys/)[CLI for administrators](https://neuralinverse.com/docs/cli/enterprise/) What's next ## Still being built. Listed so you can plan around it. None of it is part of what works today. - **Device management:** Managing developer devices from Govern, including configuration profiles and staged rollouts, is in progress. - **LDAP and Active Directory:** Directory sync is partial and is not a sign-in method. Use SAML or OIDC with SCIM. - **Console pages:** Access guardrails, access reviews and agent instruction files are configured through the API; their console pages are not available yet. ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)