The Enforcement Fabric.
The runtime layer that sees every request.
The Fabric is DataStrict's AI gateway - where enforcement physically happens. It intercepts every prompt, retrieval, tool call, and model output, applies the policy decision inline, and writes the outcome to the Ledger. It is the data-path layer the rest of the Control Layer runs on.
The data path
Every request passes through, in both directions.
A request enters the Fabric before it reaches your model. Inputs are inspected and adjudicated in stages: deterministic policy checks resolve the clear cases in microseconds, machine-learning detection classifiers trained for exactly the traffic AI carries score the rest, and only an allowed request is forwarded. The response is inspected on its way back, and the decision is recorded - all on the request path, not in a nightly job.
Because the Fabric is the boundary, the model behind it can be anything: a frontier API, a self-hosted open model, or a mock in a test. The enforcement story is identical. Every connection through it - inbound and between agents - is mutually authenticated and rides post-quantum cryptography, so traffic recorded today stays sealed against future decryption.
What it does
An enforcement boundary, by design.
Inline, not after the fact
The Fabric sits in the request path and applies its decision before a request is forwarded. Enforcement happens at the moment of the call - not in a log a dashboard reconciles later.
Bidirectional inspection
Both directions are governed: prompts, retrievals, and tool calls on the way in; model output on the way back. Exact rules and trained detection classifiers work together, so PII and secrets are stopped before the model and leakage is caught before the user.
Model-agnostic
The Fabric governs the boundary, not the model. It runs in front of any provider - OpenAI, Anthropic, or self-hosted - and several at once. Your governance travels with you when the model changes.
Deny-by-default, fail-closed
Every action starts unauthorized and is granted only by explicit policy. Deterministic checks keep the overwhelming majority of traffic off the model, and an error fails closed rather than open.
Drop-in
Change the base URL. Nothing else.
The Fabric speaks the API your clients already use. Point your existing SDK at it and every call is inspected, adjudicated, and logged - no rewrite, no per-call integration, no agent on every box.
It runs as a container inside your own environment, so this endpoint is yours - not a hop through someone else's cloud. See deployment.
# Point your existing client at the Fabric.
# Was: https://api.openai.com/v1
client = OpenAI(
base_url = "https://datastrict.internal/v1",
api_key = DATASTRICT_KEY,
)
# Every request is now inspected, adjudicated,
# and written to the Ledger - the code is unchanged.
client.responses.create(
model = "any-provider",
input = user_message,
)The system
One primitive in the Control Layer.
The Fabric is the runtime. The policy it enforces, the pipeline that grades each request, and the record it writes are the rest of the system - four primitives it connects.
The policy
Edict
The policy language the Fabric enforces - governance as versioned, testable code.
Fabric enforces
The pipeline
Adjudication
The multi-stage pipeline each request passes: deterministic rules, machine-learning detection classifiers, then a model-graded review for the genuinely ambiguous.
Fabric grades via
The record
Ledger
The append-only, hash-chained record every Fabric decision is written to.
Fabric writes to
The place
Deployment
Where the Fabric runs - inside your own environment, on-prem, private cloud, or air-gapped.
Fabric runs on
Govern AI like infrastructure.
Talk to our team about deploying DataStrict across your enterprise stack.