Know which AI touches your code, and decide what it may do.

For CISOs and security engineers who answer for the models, agents and coding tools used across engineering. Decisions are made on your servers and recorded as they are made.

For: CISOs and security engineering
Enforced in: Server-side gateways and a signed endpoint policy
Models: Deny by default
Third-party tools: Control level stated per tool
Deployment: Self-hosted, your cloud or air-gapped

What you own

What a security team answers for.

Which models see your codePrompts carry source code, configuration and sometimes customer data. Someone decides which providers and models may receive which classification of work, and in which region.

Keys and credentialsProvider keys, API keys and agent tokens end up on laptops and in pipelines. Each needs an owner, a scope and a way to revoke it.

What agents do on machinesCoding agents run commands, read files, reach the network and push code with the developer's own permissions.

Tools you did not chooseEngineers bring their own AI coding tools, and each one can be controlled to a different degree.

Responding when something goes wrongWho asked, which tool acted, which rule allowed it, and how to stop it now.

What Neural Inverse gives you

Controls that hold on the server, and fail closed.

Each row is a capability of Neural Inverse Govern or Build in use today.

Approved models onlyNothing is usable until it is allowed for the person, the project and the data's classification; a deny at any scope wins. Restricted work defaults to self-hosted or zero-retention models, and models can be limited to regions.Govern · AI Gateway

Keys stay in the vaultProvider keys are write-only and never leave Govern. Coding tools use tokens of at most one hour bound to the person's session or enrolled device, and workloads exchange a credential they already have instead of holding a static secret.Govern · AI Gateway

DLP and guardrailsEvery text part of a prompt is scanned: findings are redacted at public and internal, and refused at confidential and restricted. If the scan cannot run, the request is refused.Govern · AI Gateway

Agent policyAllow, ask or deny for shell commands, files, network, pushes, installs, hooks, MCP tools and models. Deny beats ask beats allow, and a shell line is split into every command it runs.Govern · Agent policy and approvals

Third-party tools, stated plainlyClaude Code, Cursor, Windsurf and GitHub Copilot CLI are Enforced; Gemini CLI is Managed configuration; Kiro CLI, Cline and Amazon Q Developer are Monitored. Every rule a tool cannot express is listed as a gap.Govern · Third-party AI tools

Revoke and suspendRevoke one person and their manifests deny every action on every engine. Suspend the organisation and every agent stops; the AI security kill switch refuses every gateway request until it is lifted.Govern · Agent policy and approvals · AI Gateway

IdentitySAML and OIDC single sign-on, SCIM leavers whose sessions, keys and roles end at once, and just-in-time roles approved by someone other than the requester.Govern · Identity and access

How a change moves

How an agent action moves.

The same steps apply to model requests and MCP tool calls.

Identify
Govern establishes who is acting: a person, an agent or a workload, from a short-lived credential.
Decide
The signed policy allows, asks or denies; the strictest matching rule wins.
Protect
Model and MCP calls pass DLP, guardrails, budgets and rate limits on the server.
Approve
An ask waits for a named approver in the approvals inbox. The requester never approves their own request.
Record
The decision, the rule behind it and the approval go to the hash-chained audit log.

For your auditor

What you can show an auditor.

All from one append-only log, chained per organisation and sealed with signatures every minute.

Every agent decisionWith the person, project, engine, outcome, the rule that made it and the approval behind it. Commands, paths and hosts are kept only as a hash.

Every model requestWith person, project, model, classification, tokens and cost, without prompt content. Refusals are recorded with their code.

Who held accessRole changes, sign-ins and SCIM changes written with the change; access review decisions exportable as JSON or CSV.

Signed exportsNDJSON or CSV for any time window, with a manifest signed with Ed25519 that names the file's hash and its place in the chain.

Offline verificationA standalone verifier checks exported chains and archived segments with no network access and no connection to Govern, using the public keys of your installation.

Neural Inverse provides evidence toward the standards you report against. Certification stays with your organisation and assessor.

Still being built.

Listed so you can plan around it. None of it is part of what works today.

Codex enforcementPolicy is compiled into Codex's managed configuration, but enforcement through its managed hooks is in verification. Treat it as advisory until then.

Approval escalationAutomatic escalation and auto-rejection of pending approvals are partial. Test them before you rely on them.

Talk to our team.

Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.

Request access Contact us