AIControl Docs

What is AIControl?

AIControl is enterprise AI agent governance middleware. Your agent's MCP client points at AIControl's gateway instead of the real downstream MCP server. AIControl evaluates every tools/list and tools/call against your policies with an in-process Cedar engine, logs the decision to an append-only audit trail, and forwards allowed calls to the real server.

Tagline: "The Control Plane for AI Agents."

Architecture

  AI Agent (MCP client)
     │
     ▼ POST /mcp/{server_id}/tools/list, call_tool
  ┌───────────────────────────┐
  │  AIControl Gateway        │
  │  (FastAPI, port 8001)     │
  │                           │
  │  ┌─────────────────────┐  │
  │  │ Cedar Engine        │  │
  │  │ (in-process)        │  │
  │  └─────────┬───────────┘  │
  │            │              │
  │  ┌─────────▼───────────┐  │
  │  │ audit_events        │  │
  │  │ (append-only)       │  │
  │  └──────────────────────┘ │
  └───────────┬───────────────┘
              │ allowed calls only
              ▼
     Downstream MCP server
     (registered via POST /mcp-servers)
              │
  ┌───────────▼────────────┐
  │ React Dashboard         │
  │ (port 3000)             │
  └─────────────────────────┘

Policy evaluation happens in-process, in the same request — there's no separate policy sidecar to run, deploy, or monitor. AIControl sits on the wire between your agent and the real MCP server, not in a side-channel your agent has to remember to call.

V2 Features

Community (free, MIT):

  • Deterministic policy enforcement — Cedar, evaluated in-process, not probabilistic
  • Per-agent approved_tools enforcement
  • Rate-based policies — per-session and rolling window
  • Append-only audit log — every governed call, every decision (7-day retention)
  • React dashboard — audit log, policies, agents
  • A review-effect policy match is enforced as a deny instead — Community has no Slack notification and no dashboard review queue, so a review decision would otherwise block a call with no path to resolution

Business (paid plan required):

  • Slack HITL notifications
  • In-dashboard HITL review queue — view and resolve pending reviews
  • Audit log — 30-day retention

Enterprise (paid plan required):

  • Session view / drill-down
  • Audit log CSV export
  • Audit log — 90-day retention
  • Compliance report export — AI-generated PDF mapped to EU AI Act, NIST AI RMF, SOC 2, ISO 42001
  • Natural-language policy authoring — describe a policy in English, review a generated draft, simulate it against real historical traffic, then activate

Self-Hosted

AIControl runs entirely in your environment via Docker Compose. Your audit data never leaves your infrastructure. Your LLM API key is used only for enterprise AI-native features and stays in your .env.

What's new — June 2026

First-run setup wizard — On first launch, AIControl guides the administrator through creating the root account, setting organisation name, and choosing timezone. No manual database seeding or script-issued tokens required to get started.

Password authentication — The dashboard uses email + password login with an admin-mediated magic-link invite system. Administrators invite users from the dashboard; users set their own password via a one-time link. No SMTP configuration required for the invite flow.

User management — Administrators can invite, deactivate, reactivate, and delete dashboard users from the Settings page. Root user cannot be deleted. "Reset password" sends a new magic link for locked-out active users.

Organisation settings — Set organisation name and timezone in the dashboard (Settings → Organisation). Timezone applies to all timestamp displays across the dashboard.

Policy library — 18 pre-built governance templates, grouped by category. Activate any template directly into an active policy from the Policy Library tab.

PolicyEditor — A full-width slide-over editor replaces the previous modal. Supports five condition types with type-specific form fields, live match preview, and Form/JSON toggle. No raw JSON required.

Baseline activation — After first setup, the Policies page prompts administrators to choose a governance baseline: Standard (4 dangerous-operation blocks) or Strict (8 blocks including data protection patterns). Either can be skipped.

Audit log CSV export — Enterprise installations can export filtered audit events as a CSV file directly from the Agent activity page.

Billing and subscription — The Subscription page shows plan, feature list, and estimated monthly cost based on gateway call volume.

In-process Cedar policy engine — Policy evaluation moved from an external policy sidecar to an in-process Cedar engine. Each policy compiles directly to Cedar source on write and is cached, so there's no separate process to run, deploy, or monitor, and evaluation typically completes in well under a millisecond. See Policies for the current policy model.

Natural-language policy authoring (Enterprise) — Describe the policy you want in plain English on the Policies page. AIControl drafts a scoped policy, checks that it compiles before showing it to you, and lets you simulate it against real historical traffic before you activate it. Nothing is written until you click Activate.

Regulatory Coverage

  • OWASP Agentic Top 10 AT02: Tool Misuse
  • OWASP Agentic Top 10 AT03: Identity Abuse
  • NIST AI RMF: Govern, Map, Measure
  • SOC 2 CC6.1 — Logical access controls
  • GLBA / OCC AI model risk guidance
  • HIPAA — audit trail for AI access to PHI

Next steps

  • Getting Started — install, verify, run your first governed call
  • Integration — how agents connect through the gateway
  • Policies — define what agents can and cannot do