AIControl Docs

What is AIControl?

AIControl is enterprise AI agent governance middleware. Your agent's MCP client points at AIControl's gateway instead of the real downstream MCP server. AIControl evaluates every tools/list and tools/call against your policies with an in-process Cedar engine, logs the decision to an append-only audit trail, and forwards allowed calls to the real server.

Tagline: "The Control Plane for AI Agents."

Architecture

  AI Agent (MCP client)
     │
     ▼ POST /mcp/{server_id}/tools/list, call_tool
  ┌───────────────────────────┐
  │  AIControl Gateway        │
  │  (FastAPI, port 8001)     │
  │                           │
  │  ┌─────────────────────┐  │
  │  │ Cedar Engine        │  │
  │  │ (in-process)        │  │
  │  └─────────┬───────────┘  │
  │            │              │
  │  ┌─────────▼───────────┐  │
  │  │ audit_events        │  │
  │  │ (append-only)       │  │
  │  └──────────────────────┘ │
  └───────────┬───────────────┘
              │ allowed calls only
              ▼
     Downstream MCP server
     (registered via POST /mcp-servers)
              │
  ┌───────────▼────────────┐
  │ React Dashboard         │
  │ (port 3000)             │
  └─────────────────────────┘

Policy evaluation happens in-process, in the same request — there's no separate policy sidecar to run, deploy, or monitor. AIControl sits on the wire between your agent and the real MCP server, not in a side-channel your agent has to remember to call.

V2 Features

Community (free, MIT):

  • Deterministic policy enforcement — Cedar, evaluated in-process, not probabilistic
  • Per-agent approved_tools enforcement
  • Rate-based policies — per-session and rolling window
  • Append-only audit log — every governed call, every decision (7-day retention)
  • React dashboard — audit log, policies, agents
  • A review-effect policy match is enforced as a deny instead — Community has no Slack notification and no dashboard review queue, so a review decision would otherwise block a call with no path to resolution

Business (paid plan required):

  • Slack HITL notifications
  • In-dashboard HITL review queue — view and resolve pending reviews
  • SIEM export — stream audit events to an OTLP collector or webhook (licensed API image)
  • Audit log — 30-day retention

Enterprise (paid plan required):

  • Session view / drill-down
  • Audit log CSV export
  • Policy drift detection and warning feed (Policy Drift page, licensed API image)
  • Audit log — 90-day retention
  • Compliance report export — AI-generated PDF mapped to EU AI Act, NIST AI RMF, SOC 2, ISO 42001
  • Natural-language policy authoring — describe a policy in English, review a generated draft, simulate it against real historical traffic, then activate

Self-Hosted

AIControl runs entirely in your environment via Docker Compose. Your audit data never leaves your infrastructure. Your LLM API key is used only for enterprise AI-native features and stays in your .env. Licensing is checked on your instance from a signed activation code, with no network call. Business, Enterprise and trial plans run the licensed API image; see Getting Started.

What's new — June 2026

First-run setup wizard — On first launch, AIControl guides the administrator through creating the root account, setting organization name, and choosing timezone. No manual database seeding or script-issued tokens required to get started.

Password authentication — The dashboard uses email + password login with an admin-mediated magic-link invite system. Administrators invite users from the dashboard; users set their own password via a one-time link. No SMTP configuration required for the invite flow.

User management — Administrators can invite, deactivate, reactivate, and delete dashboard users from the Settings page (/settings). The root user cannot be deleted, deactivated, or demoted. "Reset password" sends a new magic link for locked-out active users.

Organization settings — Set organization name and timezone in the dashboard (Settings → Organization). Timezone applies to all timestamp displays across the dashboard.

Policy library — 18 pre-built governance templates, grouped by category. Open any template on the Policies page's Library tab and click Activate to turn it into an active policy.

New policy modal — Create a policy from plain English (Enterprise) or with the structured editor (scope fields plus one numeric threshold condition), with a live preview of the resulting policy. Policies using other condition types are created through the API or by activating a library template.

Baseline activation — After first setup, the Overview page prompts administrators to choose a governance baseline: Standard (4 dangerous-operation blocks) or Strict (8 blocks including data protection patterns). Either can be skipped.

Audit log CSV export — Enterprise installations can export filtered audit events as a CSV file with the Export button on the Audit log page.

Billing and subscription — The Billing page shows your plan, audit retention window, feature list and gateway call counts for the current and previous month, and is where you enter your activation code.

In-process Cedar policy engine — Policy evaluation moved from an external policy sidecar to an in-process Cedar engine. Each policy compiles directly to Cedar source on write and is cached, so there's no separate process to run, deploy, or monitor. See Policies for the current policy model.

Natural-language policy authoring (Enterprise) — Describe the policy you want in plain English on the Policies page. AIControl drafts a scoped policy, checks that it compiles before showing it to you, and lets you simulate it against real historical traffic before you activate it. Nothing is written until you click Activate.

Regulatory Coverage

  • OWASP Top 10 for Agentic Applications ASI02: Tool Misuse and Exploitation
  • OWASP Top 10 for Agentic Applications ASI03: Identity and Privilege Abuse
  • NIST AI RMF: Govern, Map, Measure
  • SOC 2 CC6.1 — Logical access controls
  • GLBA / OCC AI model risk guidance
  • HIPAA — audit trail for AI access to PHI

Next steps

  • Getting Started — install, verify, run your first governed call
  • Integration — how agents connect through the gateway
  • Policies — define what agents can and cannot do