Secure AI agents at runtime
not through a proxy.
InferenceFort runs inside the agent runtime to discover AI activity, enforce policy on model and tool calls, redact sensitive data, and produce audit evidence — across cloud and local models, with no proxy to route through.
Discover
Surface the agents, models, and tool calls running across your stack — cloud or local.
Secure
Inspect context and evaluate policy on model and tool calls — allow, redact, or block before they run.
Govern
Set identity-aware policy and budgets, and capture audit evidence for the calls you govern.
AI agents outran your security stack.
You can't see what's running
- Shadow AI ships to production with no registry, no review.
- Local models (Ollama, vLLM) never touch the network — firewalls see nothing.
- No inventory. Which agents? Which models? Whose? Nobody knows.
You can't stop an unsafe call
- PII leaks. An SSN goes into GPT-4o with nothing checking it first.
- Prompt injection turns an agent's own tools into an exfiltration channel.
- DLP is blind. It sees encrypted HTTPS — it can't redact or block.
You can't set rules or prove them
- No spend caps. A 3 AM retry loop burned $40,000 unnoticed.
- No approvals. Finance okayed GPT-3.5; engineering shipped GPT-4o.
- No audit trail. Who sent what to which model? No record exists.
One panel that discovers, secures,
and governs the whole fleet.
InferenceFort runs inside the agent runtime. The moment a governed agent runs — registered or not, cloud or on-prem — it appears here: named, owned, checked against policy, and capped. This is what your security team sees.
Support
Sales
Finance
Claims
R&D
Platform
Engineering
Six capabilities. One install.
No "observe layer" sold separately, no "enforce tier" upgrade. Every capability runs in-process from the first governed call.
In-process enforcement
Policy decided inside the agent process, before the call runs. Explicit fail-open / fail-closed posture, zero hot-path network.
blocked → never left the processTool-call & MCP governance
The action layer: MCP server allow-lists, blocked and approval-gated tools, and the lethal-trifecta guard that stops injection-to-exfiltration on the third leg.
private + untrusted + exfil → blockUser attribution on every event
Every LLM and tool call carries user × agent × end-customer × decision × cost. The audit answer to "who did that?" — no anonymous calls.
user × agent × customer × costEgress & data residency
Pin each provider to approved endpoints and regions. A prompt bound for a non-approved destination is stopped before connect — the data-transfer control, enforced.
openai → *.openai.azure.com onlyPHI redaction & content rules
Safe Harbor identifiers redacted before the model ever sees the text. Substring and regex rules plus Lakera and Presidio detectors, verdicts fused.
SSN 123-45-6789 → [REDACTED]Multi-agent tracing & cost
One causal trace across agents, processes, and languages — supervisor→researcher fan-out as a DAG — with per-user, per-agent, per-customer spend and budget caps.
trace → span → agent graphNot a proxy. It runs inside your process.
A network gateway only sees encrypted traffic and never sees local models at all. InferenceFort evaluates policy on model and tool calls from inside the runtime — before they run — without rerouting traffic or sending prompts through anyone else's server.
Sovereign AI, audit-ready:
EU AI Act · NIST 800-171 · HIPAA.
Ollama, vLLM, a fine-tuned Llama on your own GPUs — local models make no external call, so network gateways, CASBs, and DLP see nothing. InferenceFort runs inside the process: private models governed exactly like cloud ones.
Invisible to everyone else
A local model call never touches the wire — perimeter tools can't inspect what never leaves. We sit at the call, not the network.
on-prem = governedAir-gap ready. Assessor ready.
Policy evaluates in-process from a cached bundle — enforcement works fully disconnected, in classified networks. Audit logs trace every action to a user, the control NIST SP 800-171 and CMMC assessments ask for first.
NIST 800-171 · CMMC · zero external dependencyOne policy, cloud to on-prem
Same rules, same audit schema for GPT-5 and llama on your GPUs. Lifetime event logging per EU AI Act Art. 12; endpoint pinning keeps data in-region for GDPR residency.
EU AI Act Art. 12 · GDPR Ch. VDeploys as an SDK.
No per-call code.
Add one package and set one environment variable. Calls made through your LangChain, LangGraph, CrewAI, Bedrock, and Ollama stack are governed at runtime — developers don't touch each call site.
- No per-call code — one package, one environment variable
- Covers cloud models and on-prem / Ollama
- Python SDK — LangChain, LangGraph, CrewAI, Bedrock, Vertex
- Multi-tenant isolation, built for enterprise deployments
# 1. add the package $ pip install inferencefort # 2. point it at your control plane $ export INFERENCEFORT_KEY=your-team-key # 3. run your app — calls are now governed at runtime $ python app.py ✓ governing: ALLOW priya@ · BLOCK ssn-rule · CAP $50/day
— connect once, and governed calls map to a real person.
We expected that.
The ones we get most often — answered as honestly as we can.
Do our prompts or customer data ever reach InferenceFort?
How do you find agents nobody told us about?
Can each team have its own models, caps, and policies?
Does this cover on-prem and local models too?
What does our team have to change to roll this out?
You've seen the problem.
You know the fix.
We're working with a small group of design partners right now. If you're shipping AI agents and want governance developers actually deploy — let's talk.