Cloud Edition
AIControls gives you real-time visibility and policy enforcement on every call — before the token is spent.
You're in. We'll be in touch to coordinate next steps.
"Which engineer called Opus 47 times yesterday?"
"Which agent is looping at $3K/week?"
"Is last quarter's spend productive work or waste?"
Your provider console won't tell you until next month. And even then, it's just one number with no breakdown.
Every AI call across your organization — who made it, which model, which team, what it cost — visible in real time. Not an aggregate total at the end of the month. The whole picture, the moment it happens.
Set the rules — which teams can access which models, what the budget limits are, who needs approval for expensive calls. Policies are written as code, stored in Git, and enforced on every call before the token is spent. If a call violates a policy, it's blocked. Everything is logged.
AIControls sits in the path between your engineers and the models they use. Every request is identity-verified — Azure AD, Okta, or Kubernetes service account — so you know exactly who's making every call. Kyverno CEL policies enforce which groups can access which models, what the budget limits are, and how exceptions get approved. Everything is logged: identity, model, cost, policy decision. The rules live in Git, reviewed like any other infrastructure change. Enforcement happens at the boundary — not after the invoice arrives.
AIControls is from Nirmata, the unified governance and policy-as-code company behind Kyverno, the most widely adopted policy engine in the world. 3.2B+ downloads. CNCF graduated. Running in production at the world's largest financial services, healthcare, and industrial enterprises.
Pricing
$5 per identity per month. 10K requests included.
Developers and agents priced the same.
Cost attribution, identity governance, and policy enforcement on every AI call — whether the caller is a developer or an autonomous agent.
150+ identities, self-hosted VPC deployment, or both. Everything in Team plus HA, SCIM, extended audit retention, and dedicated support with SLAs.
Built on Kyverno, by the team that created it. The same policy-as-code engine that governs cloud-native infrastructure, applied to your AI workloads.
Adjust identities and request volume. Developers and agents count equally from the same pool.
| Feature | Team | Enterprise |
|---|---|---|
| Identity &Access | ||
| Developer session governanceTrack and control every developer's AI session with time-bound tokens | ✓ | ✓ |
| Agent identity governanceAssign identities to autonomous agents and service accounts | ✓ | ✓ |
| OIDC / corporate SSOAuthenticate via your existing identity provider — Google, Azure AD, Okta | ✓ | ✓ |
| Google / Azure AD group resolutionMap corporate groups to policies automatically | ✓ | ✓ |
| Policy &Enforcement | ||
| Built-in policiesModel allow/deny lists, rate limits, and PII detection out of the box | ✓ | ✓ |
| Custom policy-as-codeWrite declarative YAML rules enforced deterministically at the proxy | ✓ | ✓ |
| MCP tool enforcementGovern which tools AI agents can access via Model Context Protocol | ✓ | ✓ |
| HITL approval workflowsRequire human approval before high-risk actions execute | ✓ | ✓ |
| Cost Governance | ||
| Identity-level cost attributionSee exactly who is spending what, by developer or agent | ✓ | ✓ |
| Per-identity token budgetsSet spending caps per person, team, or agent | ✓ | ✓ |
| Ticket / work item attributionAttribute AI cost to the task, not just the person | ✓ | ✓ |
| Budget alertsGet notified before spend crosses thresholds you set | ✓ | ✓ |
| Audit &Compliance | ||
| Audit trailImmutable log of every AI call, policy decision, and session | ✓ | ✓ |
| NIST / EU AI Act exportGenerate compliance reports mapped to NIST and EU AI Act frameworks | ✓ | ✓ |
| SIEM integrationStream events to your existing security tooling | Basic | ✓ |
| Deployment &Scale | ||
| SaaS hostedFully managed — nothing to deploy or maintain | Default | Available |
| Self-hosted (K8s / Helm)Run in your own infrastructure with a Helm chart | Available | Default |
| SCIM user provisioningAuto-sync identities from your directory | — | ✓ |
| Audit log retentionHow long complete audit records are stored and queryable | 30 days | 1 year+ |
| Multi-providerWorks with Anthropic, OpenAI, Gemini, LiteLLM, and others | ✓ | ✓ |
| High availabilityRedundant deployment across availability zones for production uptime | — | ✓ |
| SupportHow you reach us when something needs attention | Email / Slack | Dedicated + SLA |