Governed agent platform for regulated industries
Build or connect agents, give each one an identity and decide authority just in time. Difinity enforces your policies, protects sensitive data and records an accountable trail across every governed run.
Flow, the agent loop
Flow reasons with approved models while data protections and runtime policies govern the request, response and run state. It holds no state of its own, and it can propose a tool call but cannot execute one.
Not reachable from the internet
Every action leaves through the gateway. It protects tool-call data, decides authority just in time, and holds the credential it acts with. The agent never holds one, and no customer calls the gateway directly.
Segregated responsibilities
Hub and the Platform API hold the configuration and the record. Flow is the runtime that reasons through approved models while enforcing data and runtime policies. The tool gateway decides authority just in time and is the only part that acts.
Hub and the Platform API
In Hub, register agents, assign ownership and configure purpose, risk, connections, data rules and organisational policies. The Platform API holds what Hub writes, so security, technology, risk and compliance teams can see the operating boundary before the agent runs.
Flow
Flow owns the agent loop and the model connections. It reads what a run needs from the Platform API when the run starts, applies data protections and runtime policy to model requests and responses, then proposes a tool call with its arguments, the stated task and the reason for it.
The tool gateway
The gateway handles tool calls only. It protects the data carried in the call, evaluates action authority just in time, and uses the credential it holds only after an allow decision. Other requests are blocked or escalated for review. It is unreachable from the internet.
The complete operating path
Build and connect
Use the agent builder or connect an existing agent. Give it the tools the job requires. The agent holds no credentials and cannot reach a system itself, so every action it wants to take is proposed to the tool gateway, which decides, holds the credential and acts.
Read the Agent identity and ownership guideIdentify and scope
Assign an identity, owner and purpose to each agent, then bind the agent version to its connections, tools and policies. The agent itself never receives a credential. The tool gateway holds it, and selects the connector or person credential for the verified caller at the moment it acts.
Read the Agent permissions and access control guideGovern every action
When the runtime proposes a tool or business-system action, the tool gateway reads the agent and its version, the verified caller, the tool and the real arguments, the remit and purpose it is acting under, the rule its author wrote for that tool, and what the deterministic checks already confirmed. The action is allowed, blocked or escalated without giving the agent standing access.
Read the Runtime policy enforcement guideProtect data and model use
The runtime applies PII redaction, data-handling rules, policy enforcement and model controls as the run unfolds. Govern what reaches a model, which providers may be used and how protected data is handled.
Read the PII redaction for AI agents guideRecord every run
Keep identity, intent, policy decisions, data handling, actions and outcomes in one inspectable record for operations, security, audit and compliance review.
Read the AI agent audit trails guideInside one governed run
The control is useful during execution. The evidence is useful afterward. Both are part of the same run.
Resolve the agent, its owner, the person it acts for and the governed purpose.
Inspect the requested action, intent, context and inputs.
Apply PII redaction and configured data-handling rules.
Grant just-in-time authority, block the action or require review.
Execute only the permitted action, with the gateway holding the credential.
Link the decision, action and outcome in the run evidence.
Whole-run governance
A model call is only one step in an agent run. The agent may also read a customer record, update a claim, issue a payment or create a case. Difinity connects those decisions and actions to one identity, one policy context and one run trail without replacing your systems of record.
Adopt with evidence
Choose a real workflow and name the outcome.
Map its data, systems, actions and accountable owner.
Test policy outcomes, blocks and escalations on a bounded workflow before you widen it.
Use run evidence to expand scope with confidence.
An agent governance platform controls how agents operate across their full lifecycle and each individual run. It connects identity, ownership, authority, tools, data protection, runtime policy, human review and run evidence so an enterprise can control what an agent does and show what happened.
An AI gateway usually governs traffic between an application and a model. Agent governance covers the wider run, including the agent identity, requested tool or system action, purpose, context, sensitive data, runtime decision, fallback and outcome. Difinity can govern model use as part of that run, but it is not positioned as a gateway product.
Yes. Teams can build agents on Difinity or connect existing agents to the governed runtime. The integration depends on where tool calls and business-system actions execute, so the practical first step is to map one bounded workflow, its connections and the actions that need control.
The agent does not receive blanket standing access. When the runtime proposes a tool call, the tool gateway reads the agent and its version, the verified caller, the tool and the real arguments, the remit and purpose, the rule its author wrote for that tool, and the stated task and reason. It then allows that specific action, blocks it or routes it to a person.
Controls can cover the identity of the agent and of the person it acts for, tool permissions, business-system actions, transaction thresholds, network egress, PII handling, model and provider use, and defined human-review paths. The enforceable boundary depends on the systems and credentials connected through the governed runtime.
The record links the agent and its version, the message that started the run, each guardrail verdict and model turn, the tool and arguments the agent proposed, the gateway decision, any approval asked for and answered, each executed action and whether it failed, redactions by the kind of value replaced, and the run outcome. Tool results are not stored in full by default; that is a choice an organisation makes. Reviewers can inspect one connected run instead of reconstructing events across unrelated logs.
No. Existing systems remain the systems of record. Difinity provides the configuration surface, the governed runtime and the evidence path around the agent actions that reach those systems, tools and model providers.
No platform creates compliance or certification by itself. Difinity helps teams apply operational controls and produce evidence that supports EU AI Act and ISO/IEC 42001 readiness, reviews and audits. Final obligations depend on the organisation, use case and applicable legal requirements.
Your first governed run