# Security teams · Solutions > For CISOs and security engineers who answer for the models, agents and coding tools used across engineering. Decisions are made on your servers and recorded as they are made. Source: https://neuralinverse.com/solutions/security-teams/ --- ![](/photos/facility.jpg) [Solutions / CISOs and security engineering](https://neuralinverse.com/solutions/) # Know which AI touches your code, and decide what it may do. For CISOs and security engineers who answer for the models, agents and coding tools used across engineering. Decisions are made on your servers and recorded as they are made. For CISOs and security engineering Enforced in Server-side gateways and a signed endpoint policy Models Deny by default Third-party tools Control level stated per tool Deployment Self-hosted, your cloud or air-gapped What you own ## What a security team answers for. - **Which models see your code:** Prompts carry source code, configuration and sometimes customer data. Someone decides which providers and models may receive which classification of work, and in which region. - **Keys and credentials:** Provider keys, API keys and agent tokens end up on laptops and in pipelines. Each needs an owner, a scope and a way to revoke it. - **What agents do on machines:** Coding agents run commands, read files, reach the network and push code with the developer's own permissions. - **Tools you did not choose:** Engineers bring their own AI coding tools, and each one can be controlled to a different degree. - **Responding when something goes wrong:** Who asked, which tool acted, which rule allowed it, and how to stop it now. What Neural Inverse gives you ## Controls that hold on the server, and fail closed. Each row is a capability of Neural Inverse Govern or Build in use today. - **Approved models only:** Nothing is usable until it is allowed for the person, the project and the data's classification; a deny at any scope wins. Restricted work defaults to self-hosted or zero-retention models, and models can be limited to regions. - **Keys stay in the vault:** Provider keys are write-only and never leave Govern. Coding tools use tokens of at most one hour bound to the person's session or enrolled device, and workloads exchange a credential they already have instead of holding a static secret. - **DLP and guardrails:** Every text part of a prompt is scanned: findings are redacted at public and internal, and refused at confidential and restricted. If the scan cannot run, the request is refused. - **Agent policy:** Allow, ask or deny for shell commands, files, network, pushes, installs, hooks, MCP tools and models. Deny beats ask beats allow, and a shell line is split into every command it runs. - **Third-party tools, stated plainly:** Claude Code, Cursor, Windsurf and GitHub Copilot CLI are Enforced; Gemini CLI is Managed configuration; Kiro CLI, Cline and Amazon Q Developer are Monitored. Every rule a tool cannot express is listed as a gap. - **Revoke and suspend:** Revoke one person and their manifests deny every action on every engine. Suspend the organisation and every agent stops; the AI security kill switch refuses every gateway request until it is lifted. - **Identity:** SAML and OIDC single sign-on, SCIM leavers whose sessions, keys and roles end at once, and just-in-time roles approved by someone other than the requester. How a change moves ## How an agent action moves. The same steps apply to model requests and MCP tool calls. 1. Identify Govern establishes who is acting: a person, an agent or a workload, from a short-lived credential. 2. Decide The signed policy allows, asks or denies; the strictest matching rule wins. 3. Protect Model and MCP calls pass DLP, guardrails, budgets and rate limits on the server. 4. Approve An ask waits for a named approver in the approvals inbox. The requester never approves their own request. 5. Record The decision, the rule behind it and the approval go to the hash-chained audit log. For your auditor ## What you can show an auditor. All from one append-only log, chained per organisation and sealed with signatures every minute. - **Every agent decision:** With the person, project, engine, outcome, the rule that made it and the approval behind it. Commands, paths and hosts are kept only as a hash. - **Every model request:** With person, project, model, classification, tokens and cost, without prompt content. Refusals are recorded with their code. - **Who held access:** Role changes, sign-ins and SCIM changes written with the change; access review decisions exportable as JSON or CSV. - **Signed exports:** NDJSON or CSV for any time window, with a manifest signed with Ed25519 that names the file's hash and its place in the chain. - **Offline verification:** A standalone verifier checks exported chains and archived segments with no network access and no connection to Govern, using the public keys of your installation. Neural Inverse provides evidence toward the standards you report against. Certification stays with your organisation and assessor. Read next [Neural Inverse Govern → Identity, model access, agent policy, approvals and audit for every AI tool. Powered by Keystone.](https://neuralinverse.com/govern/)[AI Gateway → Approved models, keys, DLP, guardrails and budgets.](https://neuralinverse.com/govern/ai-gateway/)[Agent policy and approvals → Allow, ask or deny, with named approvers.](https://neuralinverse.com/govern/agent-policy/)[Third-party AI tools → What each tool covers, and what it does not.](https://neuralinverse.com/govern/third-party-tools/) Industries[Defence and space](https://neuralinverse.com/industries/defence/)[Banking and mainframe](https://neuralinverse.com/industries/banking/)[Energy and utilities](https://neuralinverse.com/industries/energy/) Documentation[Security architecture](https://neuralinverse.com/docs/security/)[Agent policy](https://neuralinverse.com/docs/govern/agent-policy/)[Guardrails and DLP](https://neuralinverse.com/docs/govern/guardrails/)[Air-gapped installation](https://neuralinverse.com/docs/deploy/air-gapped/) What's next ## Still being built. Listed so you can plan around it. None of it is part of what works today. - **Codex enforcement:** Policy is compiled into Codex's managed configuration, but enforcement through its managed hooks is in verification. Treat it as advisory until then. - **Approval escalation:** Automatic escalation and auto-rejection of pending approvals are partial. Test them before you rely on them. ![](/photos/team.jpg) ## Talk to our team. Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation. [Request access](https://neuralinverse.com/contact/?topic=access)[Contact us](https://neuralinverse.com/contact/)