AI System Registry
Maintain a complete inventory of every AI system deployed across your organization. Track ownership, department, vendor, data sensitivity, deployment status, and approval workflows.
- ✓ Full CRUD with detail and edit views
- ✓ Lifecycle status: Draft, Under Review, Approved, Deployed, Retired, with archive and delete
- ✓ Link systems to agents, risk assessments, policies, framework controls, and an EU AI Act classification
- ✓ AI-assisted risk classification and compliance gap analysis from the system page
Approval Workflows & Governance Records
Take a system from draft to deployed with staged sign-off, and keep the exceptions, evidence, and incidents an auditor will ask about right next to the system they belong to.
- ✓ Staged approval: Owner, Security, Legal, and Compliance each approve or request changes with a recorded rationale
- ✓ Approval blockers: a prohibited EU AI Act outcome hard-blocks; missing evidence or an unclassified system warns
- ✓ Time-bound governance exceptions that expire automatically, alert before they lapse, and can be revoked early
- ✓ Evidence artifacts (model cards, DPIAs, contracts) and governance incidents with linked alerts and investigations
Agent Governance Lifecycle
Govern an autonomous agent from the day it is designed to the day it is retired, and make every step real at the proxy. A charter says what it is for and where it must stop; an approval gate keeps it from going live without sign-off; a kill switch stops its traffic in one click; a posture score shows where governance is real and where it is still paperwork.
- ✓ Charter: purpose, in-scope and out-of-scope actions, decision boundaries, success criteria — required before approval
- ✓ Approval gate with Owner, Security, Legal and Compliance stage reviews; FULL_AUTONOMY agents must enforce an MCP allowlist, HIGH-risk agents need a risk basis, open incidents block
- ✓ Kill switch: Suspend (or RETIRED) makes both proxies refuse the agent’s traffic with 403, recorded as a denial; Retire revokes the approval and records a disposal attestation
- ✓ Accountability roles (business, technical, risk, escalation contact), agent incidents, and a six-dimension Governance Posture score rolled up to the executive view
Human-in-the-Loop at the Proxy
Human review used to be a line in a policy. Now it is a condition the proxy checks against the arguments of every tool call the agent’s model makes — an amount over a threshold, a particular tool, sensitive data in the payload — and when it matches in Enforce mode, the call is held until a person decides.
- ✓ Structured triggers: argument conditions (amount > 1000, with numeric coercion), any call of a tool, or sensitive data detected in the arguments
- ✓ Monitor records and alerts; Enforce withholds the response with 403 human_review_required — streaming included, buffered until the model finishes
- ✓ A pending review queue shows the agent, tool, trigger and the call’s arguments; approve this exact call once, or any matching call for an hour, or reject
- ✓ Approvals are waivers both proxies honour when the agent re-runs the call; nothing is replayed, every decision is audited, and a 28-day behaviour baseline flags volume, model, caller and off-hours drift
MCP Tool Governance
See which MCP servers each agent connects to and which tools its model actually invokes, then allowlist and enforce it at the proxy — in monitor mode first, enforce mode when you are ready. Approve a server once for the whole organization and let agents inherit it.
- ✓ Every declared MCP server and invoked tool recorded per agent, streaming or not
- ✓ Server and tool allowlists with wildcards: name, host, server/tool, server/*; an org-approved catalog agents inherit
- ✓ Enforce mode returns 403 for unlisted servers and narrows allowed_tools before forwarding
- ✓ Alerts for tools outside the allowlist and for first-seen servers or tools, plus an Oversight activity feed
Framework Controls & EU AI Act
Attest to the real requirements of each framework, not just your own policies. A seeded control catalog with a cross-framework crosswalk, and a wizard that classifies every system under the EU AI Act.
- ✓ 96 seeded controls: NIST AI RMF, ISO/IEC 42001 Annex A, EU AI Act articles, SOC 2 criteria
- ✓ A compliant control satisfies its crosswalked peers as Inherited; coverage rolls up per framework
- ✓ EU AI Act wizard: prohibited practices, Annex I/III, Art. 6(3) derogation, Art. 50, GPAI, FRIA
- ✓ Applicable articles pre-created for evidence; prohibited outcomes block approval
Risk Center
Assess and visualize risk across six key dimensions with interactive heat maps, radar charts, and trend analysis.
- ✓ Six risk dimensions: Bias, Security, Privacy, Fairness, Performance, Transparency
- ✓ Interactive heat map showing risk by system and dimension
- ✓ Segment analysis: risk by department, vendor, and data sensitivity
- ✓ Risk tier trends over time (Critical, High, Medium, Low, Minimal)
Shadow AI Discovery & Enforcement
Detect unregistered and ungoverned AI tools across your organization through a broad set of automated discovery sources, then make a Block decision actually stop the tool.
- ✓ Google Workspace and Microsoft 365 OAuth scanning, Hexnode UEM device apps, CrowdStrike Falcon endpoint signals, DNS / proxy / Netskope log import, and the endpoint agent
- ✓ A 164-tool registry across 16 categories, matched on hostname, publisher, app id, and fuzzy name — so “Chat GPT” and “Perplexty” still resolve
- ✓ Each discovery records who used it, which OAuth scopes they granted, and when it was first and last seen, not just a headcount that only ever goes up
- ✓ One-click "Scan All Sources" plus a triage workflow: Discovered, Under Review, Registered, Approved, Blocked, Unblock
- ✓ Blocks that bite: an authenticated blocklist feed (text, hosts, JSON, PAC) for your DNS sinkhole, proxy, or CASB, plus app-disable at Google Workspace or Microsoft Entra ID
Endpoint Agent
Every other discovery source watches from the outside, and they all go blind in the same places. An installable agent for managed Macs and Windows machines reports what AI a device actually runs and reaches — including models served from its own loopback interface, which leaves no network trace at all.
- ✓ A signed Go binary pushed by your MDM as a LaunchAgent or Scheduled Task — no kernel extension, no Endpoint Security client, no agent fleet to babysit
- ✓ Sees what the network cannot: off-VPN laptops, personal-tier accounts, desktop apps with no vendor audit trail, and local Ollama or LM Studio servers
- ✓ Identifiers and counts only — never prompts, responses, URLs, page titles or file paths, and a dry-run mode prints the exact bytes a machine would send
- ✓ Hostnames are matched against a server-issued allowlist, so anything that is not a known AI tool never leaves the device
- ✓ Per-device tokens with one-click revocation, plus per-collector health so a machine that is under-reporting is visible instead of silently blank
Sensitive Scan & Inline DLP
Two defenses against sensitive data leaving — or coming back out of — your AI tools: scheduled leakage probes against your gateways, and passive inspection of live proxy traffic in both directions.
- ✓ Four probes per configured gateway (OpenRouter, Helicone, Portkey, LiteLLM): system-prompt extraction, credential recall, PII recall, training-data exfiltration
- ✓ Probed and skipped are recorded separately, so a clean result is never confused with an untested one
- ✓ Inline response DLP: secret extraction attempts, exfiltration attempts, sensitive data pasted into a prompt, live keys or tokens in text
- ✓ Excerpts are redacted before storage; every finding links to an alert; probes run daily or on demand
Policy-as-Code & Compliance
Define governance policies and machine-readable rules, enforce them at the proxy in real time, and track per-system compliance with a complete audit trail.
- ✓ Policy definition with framework mapping (EU AI Act, NIST, ISO 42001, SOC 2)
- ✓ Machine-readable policy rules enforced at the proxy: off, dry-run, or enforce — applied identically to Anthropic, OpenAI, Azure OpenAI, Gemini, and Bedrock traffic
- ✓ Policy Denials log of every blocked or flagged request, including MCP server denials
- ✓ Anthropic and ChatGPT Enterprise compliance feeds pull sign-ins, API-key lifecycle, and admin role grants into the same audit trail, with alerts when a key appears off-hours or from an actor nobody recognizes
- ✓ Per-system compliance status, control-level evidence, AI gap analysis, and full audit trail
Alerts & Key Usage Rules
One inbox for every governance signal, backed by rule engines you can tune — and preview — before you turn them on.
- ✓ More than a dozen alert sources, from policy violations and shadow AI discoveries to cost anomalies, EU AI Act tiers, provider security findings, and MCP tool denials
- ✓ Dangerous-prompt rules with editable regex patterns, false-positive marking, and per-rule suppression exceptions
- ✓ The same risky prompt sent through the proxy, Claude Code, and Cursor folds into one alert with an occurrence count — matched on a salted one-way hash, never on stored prompt text
- ✓ Key usage rules watch how a credential behaves: spend and token spikes, new or dormant keys, off-hours use, model allowlists, project fan-out
- ✓ Preview dry-runs a rule against recorded telemetry before it writes a single alert; open an investigation from any alert in one click
AI Oversight & Telemetry
Monitor usage, costs, and anomalies across every provider and gateway, with budgets, investigations, and prompt-risk detection sourced from your proxy — and know which system, key, and workspace each dollar belongs to.
- ✓ Provider admin APIs — Anthropic, OpenAI, Cursor, GitHub Copilot, ChatGPT Enterprise — plus Gemini / Vertex billing export and the gateways: Helicone, OpenRouter, Portkey, LiteLLM
- ✓ Every sync keeps its own schedule and watermark, says so when a provider paginates past its cap, and backfills older history on demand instead of quietly starting from today
- ✓ Cost attributed down to the API key, governed system, and provider workspace; cache reads and writes priced apart from fresh input, and an unpriced model flagged rather than charged a default
- ✓ Spend budgets by provider, system, or department; anomaly alerting; investigation workflows
- ✓ Retention you set: raw provider snapshots, usage logs, tool calls, and policy denials are pruned on a schedule instead of growing forever
Developer AI Dashboards & Session Traces
Dedicated, per-surface oversight for the AI tools your engineers use every day, sourced from a live OpenTelemetry pipeline — down to what happened inside a single session.
- ✓ Separate dashboards for Claude Platform / API, Claude Code, Cowork, Cursor, and GitHub Copilot, with ChatGPT and Codex activity alongside them
- ✓ Per-user cost, token volume, lines produced, and tool-accept rates, with a searchable audit log of events
- ✓ Session traces rebuild a session as a waterfall of turns, model calls, and tool use, with denied and flagged spans visible in place
- ✓ The proxy’s own view of each model call sits alongside the client’s: measured latency, cost, policy decision, and tool calls observed
Usage by Person & Directory Sync
Answer the question every AI budget review starts with: who is actually using this, and what does each of them cost? One row per person, totalled across every surface, with identity resolved from your directory rather than from whatever address a tool happened to report.
- ✓ One table joining the proxy, Claude Code, Cowork, Cursor, GitHub Copilot, ChatGPT, and the provider admin APIs into a single per-person cost and token total
- ✓ Directory sync from Google Workspace and Microsoft Entra ID resolves alias addresses to one person and fills in department, title, and manager
- ✓ Departments roll up automatically, so shadow AI discoveries and spend can both be read by team instead of by mailbox
- ✓ Someone who leaves is suspended in UrNammu on the next sync, and any AI usage dated after their deactivation raises an alert
Custom Reporting
Build, export, and schedule governance reports for boards, auditors, and stakeholders from a library of ready-made templates.
- ✓ Templates for risk posture, compliance, usage & cost, inventory, and audit trail
- ✓ Report builder with saved reports
- ✓ Export to PDF, CSV, and JSON
- ✓ Scheduled recurring email delivery
Executive Dashboard
Board-ready summary of your AI governance posture with scorecard metrics, 12-month trends, and period-over-period comparisons.
- ✓ Governance posture scorecard with letter grades
- ✓ 12-month rolling trend of approved vs ungoverned systems
- ✓ Period-over-period delta comparison and an EU AI Act classification board metric
- ✓ Exportable for board and executive reporting
Vendor & Provider Governance
Track AI vendor risk, contracts, and data residency at the vendor level, and audit how each configured provider is set up — not just how much it is used.
- ✓ Vendor-level risk and compliance roll-up, contract tracking with renewal alerts, residency and subprocessor mapping
- ✓ Provider Posture: side-by-side spend, tokens, incidents, exceptions, and a computed risk tier per provider
- ✓ Provider Security & Privacy Scan: live credential, encryption at rest, TLS, proxy secret, training-on-data, retention, residency, security review, contract, subprocessors
- ✓ Graded A to F per provider with pass / warn / fail per check and a verified, attested, or inferred confidence label; runs daily
Integrations & Proxy Health
Connect every external system UrNammu relies on from one place, put all of your model traffic behind one governed endpoint, and watch it in real time with a dedicated live-ops board.
- ✓ Grouped integrations for AI models, provider telemetry, gateways, MDM, identity, and observability, with credentials and sync options in one hub
- ✓ One proxy endpoint fronting Anthropic, every OpenAI /v1 path including Responses and embeddings, Azure OpenAI, Gemini, and Bedrock — with per-provider setup snippets generated for you
- ✓ Proxy Health board with live heartbeat, flagged requests, and policy denials, refreshed on its own schedule rather than when someone remembers to press sync
- ✓ Azure Monitor metrics and recent proxy writes for at-a-glance ops
