One platform: See, Protect, Prove.
Kapālins finds every AI your organisation runs, governs it where it runs, and proves it is still acting the way someone approved. In each plan a feature is view only (See), included (Protect) or included with evidence (Prove), as the pricing table shows.
Find every AI
Inventory from five ways in: the gateway, scheduled probes, audit-log connectors, identity grants and the device sensor. Shadow AI, Copilot usage, cost and the AI Trust Index.
CoverageEnforce where it runs
An AI gateway and prompt firewall, device gates for browsers, local MCP tools and egress, an inline MCP and A2A gateway, and a governed AI workspace for staff.
Gateway & firewallShow it holds
Autonomous Integrity rates every application by its weakest link. Controls are tied to live evidence, and hash-chained evidence packs go to auditors and regulators.
ProveFive ways in, because AI does not all pass one door.
A gateway sees only the traffic routed through it. Copilots, coding agents and personal accounts never touch one. Kapālins reads AI from the traffic, the tests, the logs, the logins and the laptops, and joins them into one inventory.
The AI gateway sits inline between your applications and 15 AI providers, with full payload visibility. It can allow, redact, hold or block each call.
OpenAI
Anthropic
Amazon Bedrock
Azure OpenAI
Google Vertex AIScheduled red-team probes and a firewall check run against each AI endpoint, so behaviour is tested rather than assumed.
15 audit-log sources: 13 pulled from admin APIs on a schedule and 2 pushed by webhook. They show who used which AI feature, and what changed.
Microsoft 365 & Copilot
GitHub Copilot
AWS CloudTrail
Salesforce
SlackOAuth grants in Entra and Okta are matched against 31 known AI apps. An AI app someone connected with one click shows up in the inventory.
Microsoft Entra ID
OktaA desktop sensor and browser extension recognise 69 AI tools and 14 AI web domains, including local models, coding agents and MCP servers.
Claude Code
Cursor
Ollama
LM StudioThe full list of providers, audit-log sources, identity providers, device tools and security tools Kapālins connects to today, grouped by how each connects.
Every model call inspected before it reaches the model.
Point an application at the gateway instead of the provider. It speaks the OpenAI and Anthropic API formats, so most applications change a base URL and a key. Policy runs on the way in and on the way out.
Keys and models
- A virtual key per application, so every call is tied to who made it
- Approved-model lists per key, on top of your plan’s defaults
- Routing rules, load balancing and failover across providers
- A response cache: exact match on by default, semantic match opt-in per tenant
When inspection fails
- Fail-closed or fail-open, set per tenant
- Fail-open lets the call through in monitor-only mode and records why on the call
- Sustained fail-open pauses Guard Unit billing automatically and raises an incident
- Identity and tenant isolation always fail closed
Detection depth
- Sensitive-data detection: 51 patterns in 10 regional packs, with checksum validators
- Pattern-based, plus your own custom rules; it is not machine learning
- An LLM judge for injection, jailbreak and exfiltration, self-hosted or your own model
- The cache only stores text that has already passed the outbound checks
32 rules in 7 families.
Each rule runs in audit, warn or block mode. New rules start in audit, so you see what they would catch before you let them refuse anything. Blocking is your decision, rule by rule.
Injection and jailbreak, hidden instructions, credentials and personal data in the prompt, system-prompt extraction, allowed topics and languages.
Personal data leaking in the answer, harmful content, covert exfiltration, model identity confusion and likely hallucination.
Data residency against the provider’s region, data-class ceilings, cross-tenant bleed and provider training opt-out.
Approved and blocked tools, a person’s approval before a tool runs, iteration caps and scope boundaries for agents.
Token budget caps, monthly overage thresholds and request-spike alerts, checked before the provider is called.
Refuse a model with a critical vulnerability, unverified provenance or a licence risk recorded against it.
A decaying risk score per conversation, which catches a slow “crescendo” of probing turns. It stores numbers only, never the conversation.
Keyword, topic and regex checks of your own, each with its own mode, run beside the catalogue rules.
Governance on the laptop, where coding agents and personal accounts live.
A desktop sensor for Windows and macOS and a browser extension for Chrome, Edge and Firefox. They find the AI on each machine and judge what leaves it, using the same policy as the gateway.
What the device judges
- Browser prompts and attachments. Prompts to AI sites are checked before they are sent. Files are judged on the device and only the verdict travels; the file never reaches Kapālins.
- Local MCP tools. A tool call from a local agent is checked before the tool runs.
- A2A broker. Messages from a local agent to a configured partner agent pass through a loopback broker.
- Network egress. Listed AI destinations can be refused at the resolver.
- Coding-agent hooks. Claude Code and similar agents ask before a tool runs, and get allow, hold or block back.
Each gate is switched on per tenant, and every refusal is logged against the rule that made it.
For agents that call tool servers (MCP) and other agents (A2A) through Kapālins, both legs of every call are inspected and logged.
- Tool drift: a server that adds or rewrites a tool after approval is caught
- TLS pinning on the server’s public key, in observe or enforce mode
- Agent cards verified by detached JWS signature
- Iteration caps to bound a runaway agent
Identity assurance, five rungs
- 1Asserteda name, nothing more
- 2Authenticatedpresents a credential
- 3Pinned, observekey recorded, mismatch logged
- 4Pinned, enforcea different key is refused
- 5Card verifiedsigned agent card checks out
An AI workspace for staff, with your policy built in.
Give people a capable assistant inside the tools they already use, so the personal account stops being the easy option. Every message goes through the same Policy Shield as the gateway.
What people get
Chat, shared skills and assistants, projects with files, memory, voice, web search and scheduled tasks, on the models your organisation has approved.
Where they get it
In the browser, as a Microsoft Teams tab, as an Office task pane, and as a Google Workspace add-on.
Microsoft Teams
What you control
Per-tenant policies for web search, voice, memory, tools, documents, sharing and retention, plus the model allowlist. A shared agent or skill that changes after use begins is flagged as drift.
Evidence that each AI is acting as approved.
Seeing and blocking are not enough for an auditor. Prove turns what the platform measures into statements someone outside the console can check.
Autonomous Integrity
Each application drawn as the chain it acts through, every part asked 6 questions, and the whole rated by its weakest link.
How it worksAI Trust Index
One 0–100 score for the board, from security, compliance and value pillars, with every input traceable to evidence.
How the index worksEvidence packs
Regulator-ready packs on a hash-chained evidence record, across 29 frameworks and 122+ controls.
Compliance evidencePeople and agents, from the directory you already run.
Joiners, movers and leavers reach the AI estate from your identity provider, not from a ticket. Non-human identities sit in the same registry as people.
SCIM 2.0 provisioning
Users and groups from Microsoft Entra ID, Okta, Google Workspace or Ping. Deprovisioning in the directory disables console sign-in. Groups become policy subjects.
SSO, MFA and passkeys
Single sign-on over OIDC, with multi-factor authentication and passkeys for console sign-in.
Audited just-in-time access
Support access to a tenant is time-bound and needs a reason code. Every session is logged and can be ended early.
Google
Findings land in the tools your SOC already runs.
Blocks, findings and incidents are pushed to 7 SIEM and ITSM destinations, plus signed webhooks for anything else. Natural-language search runs over the platform’s own logs.
Microsoft Sentinel
Microsoft Sentinel
Palo Alto NetworksGoogle SecOps
Palo Alto Networks
Google SecOps
BMC
BMCWhat AI costs, who spent it, and what it returned.
Cost is read from the same traffic the gateway inspects, priced against a catalogue of 953 priced models, and set beside the security and compliance view.
Cost and showback
Spend by model, team and application, on every plan. Microsoft 365 Copilot seat usage shows which paid seats sit idle.
Chargeback and value
Chargeback statements to teams and cost centres. Value realisation says which benefits were measured and which were modelled from your own inputs.
Rate and budget fences
Per-tenant, per-feature and per-key budgets and rate limits that throttle or block, which also caps a runaway agent.
See the platform on your own estate.
A 30-minute walkthrough of the five ways in, the gateway and the integrity view, on the AI you actually run.
Questions buyers ask.
Which API formats does the gateway accept?
The OpenAI chat-completions format and the Anthropic messages format, so most applications switch to Kapālins by changing a base URL and a key. Each application gets its own virtual key.
What happens if inspection is unavailable?
Each tenant chooses. Fail-closed blocks the call. Fail-open lets it through in monitor-only mode and records the gap on the call. If inspection fails open for a sustained period, Guard Unit billing pauses automatically and an incident is raised. Identity and tenant isolation always fail closed.
Is the data-loss detection machine learning?
No. Sensitive-data detection is pattern-based, with checksum validators where an identifier has one. 51 patterns ship in 10 regional packs, and you can add your own rules. An LLM judge, self-hosted or your own, can add a second opinion on injection and jailbreak.
Does the device sensor send files to Kapālins?
No. Attachments are judged on the device and only the verdict is sent. The file itself never leaves the machine.
Which identity providers are supported?
SCIM 2.0 provisioning from Microsoft Entra ID, Okta, Google Workspace and Ping. Single sign-on over OIDC, with MFA and passkeys for console sign-in.