PILLAR · SECURE
Decide what your AI is allowed to do
Deterministic policy on every LLM call, agent step, and MCP tool call - enforced at runtime, before anything happens.
Pre + post
Enforced on every call
19 types
PII detected and redacted
12+
Agent frameworks governed
< 1 line
To turn enforcement on
Where obsvr sits
Your stack has a gap
Your App
Your application
Generates LLM calls and agent runs. Routes intent to providers. No built-in control or audit.
AI Control Plane
obsvr, the enforcement layer
Intercepts every LLM call and agent run. Enforces policy before and after the prompt is sent. Signs and anchors every event.
Provider
LLM provider
Processes prompts and returns completions. No policy enforcement, no audit trail.
The missing layer
Where governance belongs in your AI stack
Policy enforcement
Rules that run, not rules that sit in a doc
Pre and post-call policy
Rules run before the prompt is sent and again after the response returns, on every LLM call and agent step.
intercept · evaluate · block | redact | allow
Shadow mode
Run a strict rule against live traffic and see what it would have done without blocking, then promote it once the impact is what you expect.
import in shadow · review · promote
Org policy packs
Versioned, content-addressed rule packs ship org-wide, and org mandates cannot be overridden locally.
versioned · content-addressed · inherited
Signed policy history
Every policy change is diffed, attributed, and hashed into the daily Merkle root, and the SDK verifies each Ed25519-signed policy against a pinned key.
who · what · when · fails closed if unverifiable
OPA / Rego export
Export the policy set as a generated .rego and data.json bundle, rules-hash stamped and parity-verified against OPA itself.
.rego + data.json · parity-verified
Approvals
A block rule can require human approval instead, granting a time-boxed, revocable pass with every decision recorded.
dashboard queue · ~30s round trip · fully audited
Agent runs
A multi-step agent, as governable as one call
Tool allowlists and denylists
Define exactly which tools an agent may invoke per run; out-of-scope tools are blocked before they execute.
per-run allow | deny
Step limits and auto-stop
Cap tool calls per run and block or escalate at the limit, with repeated identical actions raising a high-severity incident.
max steps · escalate · auto-stop
Cost governance and kill switch
Token budgets are enforced at call time, and pausing a project blocks every governed call within seconds.
per-user · per-agent · per-tenant budgets
Framework-native, output-aware
Wrap once at init and policy covers agent runs, final outputs, and every tool payload without changing agent code.
CrewAI · AutoGen · LangChain · any framework
Every step. Every tool call. Every decision logged.
Calls that violate policy are blocked before execution, and every allowed and blocked call is signed into the audit chain.
- Tool-level allow and deny enforced before execution
- Step limit triggers automatic escalation
- Output topic denylist applied on run completion
- Full trace included in the SOC 2 evidence export
MCP tools
Govern the protocol, not just the prompt
- Tool-poisoning defense at tools/list, before any call
- Description drift detection across discoveries
- Client-side, no proxy in the data path
Data controls
Sensitive data never has to leave your perimeter
19 PII types, three actions
Prompts and responses are scanned before and after the model call, and each pattern can block, redact, or detect only.
block · redact · detect_only · custom patterns
Multi-turn injection scoring
A per-session score accumulates weighted weak signals across turns and decays over time, so split attacks trip the threshold and normal traffic never does.
sdk:multi_turn_injection · decaying score
Hashed compliance record
The canonical record stores HMAC content hashes, never raw prompts, and the whole pipeline can run inside your own VPC.
hashes by default · in-VPC data plane
What gets caught, and what the record shows instead
Scans run before and after LLM contact. Each pattern can block, redact, or detect only.
****@****.***
Phone
(***) ***-****
SSN
***-**-****
Credit Card
****-****-****-****
IP Address
***.***.***.***
API Key
sk-****...
AWS Access Key
AKIA****...
JWT Token
eyJ****...
UUID
xxxxxxxx-xxxx-...
Name (NLP)
[REDACTED]
Address (NLP)
[REDACTED]
Person (NLP)
[REDACTED]
Location (NLP)
[REDACTED]
Medical Record (NLP)
MRN-****
National ID (NLP)
[REDACTED]
Private Key
-----BEGIN...
GitHub Token
ghp_****...
Slack Webhook
hooks.slack.com/...
Prompt Injection
[BLOCKED]
When things break
Your app never breaks because of obsvr
Fail open or fail closed
Fail-open by default with local buffering, or set failMode: closed to block whenever a verdict cannot be rendered.
failMode: open | closed
Local cache, graceful degradation
A local policy cache keeps rules enforced through outages, with timeouts, retries, and events that buffer and flush on recovery.
5s timeout · 3 retries · flush on recovery