aiGovernance.hero.label
aiGovernance.hero.title1
aiGovernance.hero.title2
aiGovernance.hero.description
aiGovernance.definition.label
aiGovernance.definition.title
aiGovernance.definition.p1
aiGovernance.definition.p2
aiGovernance.definition.p3
aiGovernance.challenge.label
aiGovernance.challenge.title
aiGovernance.challenge.intro
aiGovernance.challenge.items.question1
aiGovernance.challenge.items.question2
aiGovernance.challenge.items.question3
aiGovernance.challenge.items.question4
aiGovernance.challenge.conclusion
aiGovernance.framework.label
aiGovernance.framework.title
aiGovernance.framework.description
aiGovernance.framework.auditTrails.title
aiGovernance.framework.auditTrails.intro
- aiGovernance.framework.auditTrails.item1
- aiGovernance.framework.auditTrails.item2
- aiGovernance.framework.auditTrails.item3
- aiGovernance.framework.auditTrails.item4
aiGovernance.framework.auditTrails.conclusion
aiGovernance.framework.rbac.title
aiGovernance.framework.rbac.intro
- aiGovernance.framework.rbac.item1
- aiGovernance.framework.rbac.item2
- aiGovernance.framework.rbac.item3
- aiGovernance.framework.rbac.item4
aiGovernance.framework.grounded.title
aiGovernance.framework.grounded.intro
- aiGovernance.framework.grounded.item1
- aiGovernance.framework.grounded.item2
- aiGovernance.framework.grounded.item3
- aiGovernance.framework.grounded.item4
aiGovernance.framework.policy.title
aiGovernance.framework.policy.intro
- aiGovernance.framework.policy.item1
- aiGovernance.framework.policy.item2
- aiGovernance.framework.policy.item3
- aiGovernance.framework.policy.item4
aiGovernance.useCases.label
aiGovernance.useCases.title
aiGovernance.useCases.description
aiGovernance.useCases.regulated.title
aiGovernance.useCases.regulated.description
aiGovernance.useCases.workflows.title
aiGovernance.useCases.workflows.description
aiGovernance.useCases.compliance.title
aiGovernance.useCases.compliance.description
aiGovernance.useCases.consulting.title
aiGovernance.useCases.consulting.description
aiGovernance.whyKriftai.label
aiGovernance.whyKriftai.title
aiGovernance.whyKriftai.description
aiGovernance.whyKriftai.workflows.title
aiGovernance.whyKriftai.workflows.description
aiGovernance.whyKriftai.personas.title
aiGovernance.whyKriftai.personas.description
aiGovernance.whyKriftai.sovereign.title
aiGovernance.whyKriftai.sovereign.description
aiGovernance.whyKriftai.noLockin.title
aiGovernance.whyKriftai.noLockin.description
aiGovernance.compliance.label
aiGovernance.compliance.title
aiGovernance.compliance.description
aiGovernance.compliance.gdpr.title
aiGovernance.compliance.gdpr.description
aiGovernance.compliance.financial.title
aiGovernance.compliance.financial.description
aiGovernance.compliance.healthcare.title
aiGovernance.compliance.healthcare.description
aiGovernance.compliance.government.title
aiGovernance.compliance.government.description
aiGovernance.enterprise.label
aiGovernance.enterprise.title
aiGovernance.enterprise.description
aiGovernance.enterprise.why.title
aiGovernance.enterprise.why.description
aiGovernance.enterprise.comparison.title
aiGovernance.enterprise.comparison.description
- aiGovernance.enterprise.comparison.item1
- aiGovernance.enterprise.comparison.item2
- aiGovernance.enterprise.comparison.item3
- aiGovernance.enterprise.comparison.item4
aiGovernance.enterprise.deployment.title
aiGovernance.enterprise.deployment.description
aiGovernance.enterprise.roi.title
aiGovernance.enterprise.roi.description
aiGovernance.faq.label
aiGovernance.faq.title
aiGovernance.faq.q1.question
aiGovernance.faq.q1.answer
aiGovernance.faq.q2.question
aiGovernance.faq.q2.answer
aiGovernance.faq.q3.question
aiGovernance.faq.q3.answer
aiGovernance.faq.q4.question
aiGovernance.faq.q4.answer
Technical Architecture
12 layers of governance — from input to output to audit
KriftAI governance is not a prompt instruction. It is a 12-layer security architecture enforced at the code and database level. Even if the LLM ignores its system prompt, the governance layers catch it.
Every AI call passes through a single governed choke point — a wrapper function that enforces input validation, model invocation, output validation, and audit logging in sequence. Governance cannot be bypassed because it is the only call path.
Single Governed Choke Point
Every AI call routes through one governed wrapper. Input validation → LLM call → output validation → audit log. This is the standard call path — governance cannot be bypassed by forgetting to add it in one route.
Input Validation — Prompt Injection Detection
Pre-model detection of role-override attempts ('ignore previous instructions'), persona hijacking (DAN/jailbreak), system-prompt extraction, delimiter injection, and 'disable governance' attempts. A high-severity hit blocks the call before the model is ever invoked.
Output Validation — Prohibited Content Scanning
Post-model scan of every AI response against universal rules (injection leaks, jailbreak persona leaks, system prompt exposure, credential redaction) and workspace-specific rules (e.g., pharma blocks prescribing, order validator blocks sanction overrides). Severities: block, warn, or redact.
Citation Verification — Anti-Hallucination
Deterministic verification that claims are backed by real data. Citations are withheld unless the cited content actually exists in the retrieved knowledge base chunks. Fabricated references never reach the user. Where applicable, a deterministic engine computes and the LLM only narrates — the model never invents the numbers.
Knowledge Grounding — RAG Constraint
Knowledge-grounded workspaces retrieve project-scoped chunks and instruct the model to answer only from them. No retrieval means 'I don't have that information' instead of guessing. Grounding is scoped per project and per organization — one tenant cannot pull another's data.
Tool-Use Restrictions
Default-deny tool access. Even if the model requests a tool, the platform blocks it unless the workspace is explicitly permitted. Development workspaces may allow file tools but deny destructive operations. Each workspace defines its own tool allowlist.
Immutable Audit Log — Full Traceability
Every AI call is recorded: user, persona, workspace, action, input/output summaries, model and provider, token estimate, and the governance verdict (input safe? threats detected? output passed/blocked/violations?). Every AI decision is traceable and reconstructable.
Human Override — Break-Glass Escalation
When governance blocks a response, the user can request an override with a documented reason. If they lack permission, it escalates to an admin. The decision — approved or denied, by whom, and when — is itself written to the audit log immutably.
Database-Level Tenant Isolation
Multi-tenancy enforced at the database layer with row-level security policies scoped by organization and project membership. Governance is not just application-layer — the database itself refuses cross-tenant reads regardless of application logic.
Custom Persona Moderation
User-created persona prompts are screened through content moderation, an injection blocklist, and automatic guardrail wrapping — so a custom persona cannot be used to smuggle in a jailbreak. System personas are defined in code, not stored in the database.
Abuse & Cost Controls
Per-user and per-API-key rate limiting, token-usage metering with configurable monthly caps, input size limits, and fast blocklist moderation on chat messages. Prevents runaway costs and abuse without degrading legitimate usage.
Credential Governance
Centralized BYO-key vs platform-key resolution and provider/model selection. API keys are encrypted at the application layer. Credential handling is consistent and auditable — not scattered across individual routes.