Python
ormai
Use it to let an agent query a database, safely.
Solution · Agent controls
Give security something it can approve
We implement the testable controls that let an AI system pass a security review or enterprise procurement: scoped permissions, human approvals, audit trails and evaluation evidence.
Usually owned by: CTO, CISO or the security sponsor who must approve an AI system — or the product leader whose deal depends on it.
The situation
Recognise where you are
An AI system that can read data and take actions raises questions that ordinary software does not: what exactly can it do, on whose authority, how would you know if it did something it should not, and how can a reviewer verify any of that without trusting the model?
Security reviews and enterprise questionnaires increasingly ask these questions directly. A system that answers them with prompt instructions — “the model is told not to” — will not pass, and should not. The controls have to live in software that the model cannot talk its way around.
Our work is to put them there: permission boundaries enforced outside the model, approval points for consequential actions, audit records a reviewer can query, and evaluation evidence that the controls behave as described.
How we approach it
From the system you have to the result you need
- 1
Map authority
List the actions and data the system touches, who has authority over each, and which actions are consequential enough to need approval.
- 2
Enforce outside the model
Implement scoped permissions, argument validation and policy checks in the tool layer, so the model cannot exceed them whatever it generates.
- 3
Record and approve
Add attributable audit records and human approval steps where the consequence warrants them, without making routine work slower than necessary.
- 4
Produce evidence
Write tests that attempt prohibited actions and show they fail, and document the controls in the form reviewers ask for.
Scope
What we need, what you receive
- What we need from you
- The AI system, its tools and the data and actions it can reach.
- The review or questionnaire that must be satisfied, if there is one.
- Who holds authority over each data source and action.
- Existing identity, logging and approval systems the controls should use.
- What you receive
- An authority map of actions, data, owners and approval requirements.
- Implemented permission, validation, approval and audit controls in the tool layer.
- Tests demonstrating that prohibited actions are blocked and approvals are enforced.
- Control documentation suitable for the security review or customer questionnaire.
- Not included
- Formal certification, penetration testing or legal compliance sign-off.
- Organisation-wide security programmes beyond the AI system in scope.
- Claims that the model itself is safe, which no control layer can establish.
- How success is measured
- Prohibited actions fail in tests regardless of model output.
- Every consequential action is attributable and reviewable.
- The reviewer or customer accepts the control evidence.
Decision guide
The questions buyers ask, in the order they ask them
01
Why can’t we rely on the system prompt for safety?
Because the model generates its own actions, and instructions can be overridden by inputs it reads. Controls that matter must be enforced in the software that executes actions, where they apply whatever the model produces.
02
What do security reviewers actually want to see?
Enumerated actions and data, least-privilege access, approval for consequential actions, attributable audit records and tests that show the boundaries hold. Clear documentation of each matters as much as the controls themselves.
03
Will controls make the system unusable?
Not if approval is reserved for consequential actions. Most reads and routine steps can proceed under scoped permissions; the design work is deciding where a human checkpoint is genuinely worth its cost.
04
What does this cost, and how long does it take?
A defined controls work package is usually a fixed-scope sprint, sometimes preceded by a short review to map authority. Indicative ranges are published on the engagement pages.
Evidence
What you can check before trusting us
Client results and public engineering are kept apart; the evidence method explains why.
Client delivery
No client case study is published for this situation yet. See all case studies.
Neul Labs public engineering
Neul-owned work you can inspect — not client case studies or warranties, and never a requirement.
Python
closegate
Use it to gate finance agents behind approval policy.
Rust
agentvfs
Use it to sandbox an agent’s files and shell.
Java
regulus
Use it to make a Google ADK agent regulator-ready.
Rust
mcp-pay
Use it to charge for MCP tools across payment rails.
Further reading
A good fit
- A specific review, customer requirement or regulated deployment is driving the work.
- The system’s actions and data sources can be enumerated.
- The organisation is willing to add approval steps where the risk warrants it.
Not a good fit
- The aim is to pass a review without changing how the system works.
- The requirement is a certification only an accredited body can grant.
- The system’s actions cannot be enumerated or constrained.
Questions people ask
Can you help us pass a specific security questionnaire?
We can implement and document the technical controls the questionnaire asks about. The answers remain yours, and certification or legal sign-off sits with the appropriate bodies.
Do controls require changing our agent framework?
Usually not. Most controls are implemented in the tool and data layer the framework calls, which is framework-independent.
Can AI agents have safe database access?
They can have scoped, validated and audited access. That means policy-enforced queries, field and tenant restrictions and attributable records — not raw SQL from model output.
Other situations we help with: launch production ai · rescue an ai project · automate a business workflow · make ai useful for a team.
Give security something it can approve
Without enforceable controls, the system either never launches, launches with risk the business has not accepted, or loses the enterprise customers who ask.
Scope this with us