A control layer for every model, dataset, and decision.
DataStrict is the runtime layer that decides what your AI is allowed to do - not a dashboard that reports on it afterwards. Six primitives turn governance from documentation into enforcement.
The boundary
One layer in the request path.
Every prompt, retrieval, tool call, and output passes through a single, auditable layer. Nothing reaches a model - or leaves one - without being evaluated against policy first.
The system
Six primitives. One enforcement boundary.
Enforcement Fabric
RuntimeThe data-path layer. Sits inline between your data, models, and users - intercepting prompts, retrievals, tool calls, and outputs, and applying decisions before anything crosses the boundary.
Edict
Policy languageGovernance expressed as code. A declarative policy language - versioned, reviewed, and tested like software - that binds every decision to identity, purpose, and jurisdiction.
Adjudication
EvaluationA multi-stage pipeline. Deterministic rules resolve the clear cases in microseconds; an ensemble of machine-learning classifiers, trained and tuned against the latest prompt-injection and data-exfiltration techniques, scores the rest; only genuinely ambiguous requests escalate to a model-graded review.
Ledger
EvidenceAn append-only, hash-chained record of every decision. Immutable, queryable proof - built so evidence is a side effect of enforcement, not a quarterly reconstruction from logs.
Control Atlas
ComplianceThe mapping from regulatory obligation to enforceable control. EU AI Act, NIST AI RMF, SOC 2, HIPAA, and GDPR resolve to concrete Edict policies - so a framework becomes runtime, not a binder.
Simulation
Pre-flightShadow mode for policy. Replay real or synthetic traffic against a candidate Edict to see exactly what it would block, redact, or escalate - before a single live request is affected.
Adjudication
Cheap when it can be. Careful when it must be.
A single model call on every request is slow and expensive. Adjudication is layered: deterministic rules clear the obvious cases instantly, and only what is genuinely ambiguous reaches a model-graded review or, for the highest-stakes calls, a human reviewer.
Deterministic policy
Edict rules evaluated in microseconds. The majority of requests resolve here, with zero model cost.
Classifier ensemble
PII, secrets, and intent detection score the request against trained models when rules aren't enough.
Model-graded review
Only ambiguous cases escalate to an LLM-judge that grades the request against the policy's intent.
- Allow
- Redact
- Block
- Escalate
Edict · policy language
Governance, expressed as code.
A binder of AI policy is unenforceable. An Edict is the same intent, made executable - so the policy is the runtime.
- Versioned, reviewed, and tested like code - never a document.
- Bound to identity, purpose, and jurisdiction at evaluation time.
- Validated in Simulation against real or synthetic traffic before it enforces.
policy "customer-assistant" {
applies_to = agents.support.*
region = "eu-west"
deny when output.contains(pii.ssn)
redact output.matches(pii.email, pii.phone)
allow tools = ["orders.read", "kb.search"]
deny tools = ["payments.*", "exports.*"]
escalate when adjudication.confidence < 0.8
audit = always
}Control Atlas
From obligation to enforced control.
Auditors ask whether a requirement is met. The Atlas answers with a control that runs - mapping each framework to the Edict policy that enforces it.
Simulation
Know what a policy does before it does it.
Promoting a policy blind is how enforcement breaks production. Simulation replays real or synthetic traffic against a candidate Edict and reports exactly what would have changed - so you ship governance with the confidence of a tested deploy.
Console preview - illustrative figures.
Govern AI like infrastructure.
Talk to our team about deploying DataStrict across your enterprise stack.