The governance layer that lets your AI clear the review

Guardrails on every input and output, an evaluation gate before anything ships, full observability and an audit trail a regulator will accept - around the AI you build with us and the AI you already run.

7 checks per callAudit-ready by designWraps any model or agent
customer-copilot · request
Governed
Input guardrailsPII · injection · policy
Model / agentany model - screened live
Output guardrailsredact · safety · policy
Evaluation gategroundedness · safety
Allowed · loggeddecision + audit trail
VerdictAllowRedactBlockEscalate
7 checks·every call logged·runs in your cloud
See it run
The bottleneck

Most enterprise AI doesn't fail in the demo - it stalls at the review

The model works. Then it meets security, risk and compliance, and the questions start: what stops a bad input, who approved this, where is the evidence. Sentinel is built so those answers already exist before anyone asks.

The pilot passed. The review didn't.

A prototype that impresses in a sprint review still has to clear security, model-risk and compliance before it touches a customer. Without guardrails, evals and an audit trail, it has no way to answer the questions those teams are paid to ask - so it waits.

Guardrails bolted on late, or never

Input and output controls, eval gates and logging get deferred until compliance asks, then retrofitted under pressure onto a system that was never designed for them. Governance added at the end is expensive, brittle, and never quite complete.

No evidence a regulator will accept

“Trust us, it's safe” is not an artifact. Under the NIST AI RMF and the EU AI Act you have to show what was tested, what was decided and what actually happened in production - and most AI systems simply never record it.

What Sentinel does

Six controls that turn an AI system into a governed one

Sentinel wraps any model or agent with the controls an enterprise review expects - enforced at runtime on every call, not written in a policy document nobody reads.

Input guardrails

Every request is screened before it reaches the model: PII and sensitive-data detection, prompt-injection and jailbreak checks, and topic and policy filters. Malicious or out-of-bounds input is caught at the door, not after the damage.

PII detectionInjection defenseTopic & policy

Output guardrails

Every response is screened before it reaches the user: PII redaction, toxic and unsafe-content filtering, and enforcement of the policies your business runs on. What the model says is checked as carefully as what it's asked.

PII redactionSafety filterPolicy enforcement

Evaluation gates

Groundedness, accuracy and safety evals run before anything ships and keep running in production. A change clears the gate only when it meets the bar you set - so quality is a release requirement, not a hope.

GroundednessAccuracySafetyRelease gate

Observability

Distributed tracing, latency, cost, quality and drift on every call, with alerting when something moves. You can see what your AI is doing in production - and be told before a small drift becomes an incident.

TracingLatency & costDriftAlerting

Audit trail & lineage

Every prompt, decision, tool call and action is written to an immutable trail, with the lineage that connects an output back to its inputs and its version. When someone asks “what happened, and why”, the answer is already recorded.

Immutable logLineageEvidence packs

Access control & policy

Who and what may call which model, tool or dataset is defined once and enforced centrally with role-based access and a policy engine. Authority is scoped on purpose - not discovered after an agent does something it shouldn't.

Role-based accessPolicy engineScoped authority
See it work

Watch a request pass through the guardrails

Five requests, checked one after another. Sentinel sends each down the guardrail stack - input guards, the model, output guards and an eval gate - and returns a decision with an audit entry to match. Pick any request to jump straight to it. This is an illustration of how Sentinel behaves, not a live model call.

Normal question
7-layer stack
Inbound request

Sending this request down the guardrail stack

Same stack on every request - the safe ones pass, the rest are redacted, blocked or escalated, and all of it is logged.

Under the hood

Six steps from an AI system to a governed one

Sentinel follows the same path whether it's governing a Focaloid-built solution or wrapping an AI system you already run.

1

Map

Classify the AI system and its risk - what it does, what data it touches, and how the NIST AI RMF and EU AI Act apply. Governance is scoped to the risk, not one size for all.

2

Guard

Wrap inputs and outputs with the guardrails the system needs - PII, injection, topic, safety and policy - enforced on every call from day one.

3

Gate

Stand up evaluation gates for groundedness, accuracy and safety, and wire them into the release path so nothing ships below the bar you set.

4

Observe

Instrument the system with tracing, metrics, cost and drift detection, with alerts that fire before a drift becomes an incident.

5

Record

Capture every prompt, decision and action in an immutable audit trail, with the lineage that ties each output to its version and its inputs.

6

Review

Produce the evidence pack risk, security and regulators actually ask for - the tests, the decisions and the production record, ready to hand over.

Reference architecture

A control plane that wraps any AI runtime

Sentinel sits between the request and the response - screening what goes in and what comes out, gating what ships, and recording all of it - around a model or agent it doesn't need to own.

In
Inbound request
user message · event · agent tool call
Input guardrails
PII & sensitive data · prompt-injection / jailbreak · topic & policy
Policy & access control
role-based access · which model, tool and data this caller may invoke
Model / agent runtime
Claude · open-weight · fine-tuned · your agent - Focaloid-built or already running
Output guardrails
PII redaction · toxic & unsafe-content filter · policy enforcement
Evaluation gate
groundedness · accuracy · safety - before ship and in production
Governed response
returned to the user - or blocked, redacted or escalated to a human
Spanning every step - the Sentinel control plane
Distributed tracing
Metrics & cost
Drift detection
Immutable audit trail
Data lineage
Evidence packs
Out

Wraps any model or agent - Focaloid-built or the AI you already run.

Method + mechanism

The method decides what “safe” means. Sentinel enforces it.

Focaloid's AI Governance methodology is how we decide whether an AI system is safe, fair and accountable. Sentinel is the production-grade machinery that makes those decisions true at runtime - the same evidence, generated automatically. You use them together.

The method

AI Governance

How we decide an AI system is safe, fair and accountable.

  • A nine-phase lifecycle with a documented go/no-go gate between every phase.
  • Mapped to the NIST AI RMF, the EU AI Act and ISO/IEC 42001.
  • Ends in a signed governance verdict - a human decision, on the record.
Explore the methodology
+
method + mechanism
The mechanism

Sentinel

The runtime that makes those decisions true on every call.

  • Guardrails, eval gates and access control enforced on every request.
  • Observability and an immutable audit trail, running in production.
  • Generates the evidence each phase and gate needs - automatically.
Deployed in your cloud, around any model or agent.
In production

The governance layer under every AI system we run

Sentinel isn't a roadmap item - it's how Focaloid ships regulated AI today, and how we make AI that's already live ready for the review it hasn't passed yet.

Regulated SaaS · FinTech · WealthTech · InsurTech
In production

Every copilot and agent we run, governed by Sentinel

The AI copilots and multi-agent workflows Focaloid operates for regulated clients run inside Sentinel: guardrails on every call, human-in-the-loop on irreversible actions, and EU AI Act-aligned documentation generated as the system runs. The audit trail exists because the system was built to write it.

Already live?

We make your existing AI review-ready

An in-house model or agent that shipped without a governance story doesn't have to be rebuilt. Sentinel wraps it - guardrails, evals, observability and an audit trail added around what you already run - so it can pass a security and model-risk review on its next attempt, not its fifth.

Where Sentinel fits

Wherever an AI decision has to be defensible

If an AI system touches regulated data, faces a review, or makes a decision someone will later question, it needs the controls Sentinel provides.

FinTech & WealthTech Regulated

Copilots and agents over payments, portfolios and advice - where a wrong or unsupported output is a compliance event, not just a bug.

AdvicePaymentsPortfolios

HealthTech Regulated

AI over clinical and patient data, where PII controls, groundedness and a complete audit trail are not optional extras.

PHI controlsGroundednessFull trail

InsurTech Regulated

Underwriting, claims and servicing AI that has to show fair, consistent and explainable decisions on demand.

UnderwritingClaimsExplainability

EU AI Act & NIST AI RMF programs

Any team that has to map, measure and manage AI risk and produce evidence for it - Sentinel generates that evidence as the system runs.

MapMeasureManageEvidence

Security & model-risk teams

The reviewers who have to sign off. Sentinel gives them enforced guardrails, scoped access and a record they can actually inspect.

Scoped accessInspectable record

AI you already shipped

A model or agent that's live but ungoverned. Sentinel wraps it and makes it review-ready - without a rebuild.

No rebuildWrap & governWeeks, not quarters
Why Sentinel, why us

Governance that's part of the system, not a document about it

Plenty of tools can filter a prompt. Fewer are built so you'd stake a regulated system on the result - and hand your reviewers the evidence to prove it.

Built in, not bolted on

Guardrails, evals, audit and access are properties of the runtime from day one - not a retrofit for when compliance finally asks.

Framework-aligned

Mapped to the NIST AI RMF and the EU AI Act, ISO/IEC 42001-aligned and delivered by an ISO/IEC 27001-certified team - so the evidence counts where it matters.

Wraps any model or agent

Claude, open-weight, fine-tuned or a third-party agent; Focaloid-built or already running. Sentinel governs it without owning it.

Evidence a regulator accepts

Not a dashboard of numbers - the tests, decisions and production record an auditor or model-risk team will actually take.

Deploys in your cloud

Runs inside your own environment and security perimeter. Your prompts, outputs and audit trail never have to leave to be governed.

The mechanism behind the method

Sentinel is the runtime enforcement of Focaloid's AI Governance methodology - method and mechanism from one team.

Solutions & Accelerators

Accelerators that make production faster - and safer.

Two kinds of reusable IP: the tooling we build and govern with, and the solutions that drop straight into a use case. Sentinel is the governance layer under every one of them - the ready-to-fit ones included.

Sentinel is the layer underneath the whole board. Forge composes and runs the workflows, Blocks supplies the patterns, Velocity carries them through the delivery lifecycle - and Prism and Echo are what they add up to when pointed at a real use case. Every one of them runs inside Sentinel's guardrails, eval gates and audit trail.

Method + mechanism

Sentinel is how the framework becomes real

Focaloid's AI Governance methodology defines how an AI system is proven safe, fair and accountable - a nine-phase lifecycle mapped to the NIST AI RMF, the EU AI Act and ISO/IEC 42001. Sentinel is the production-grade layer that enforces it on every call and generates the evidence each gate needs. Method and mechanism, from one team.

Explore the AI Governance framework
What's inside

The technology behind Sentinel

Proven guardrail, evaluation and observability components, assembled into one governance layer - chosen for what a review will accept, not for a logo on a slide.

Guardrails

PII
PII detect & redact
INJ
Prompt-injection defense
FLT
Input / output filters
POL
Topic & policy

Evaluation

EVL
Eval harness
GRD
Groundedness
RED
Red-teaming
SAF
Safety scoring

Observability

OTel
OpenTelemetry
MET
Metrics & cost
DRF
Drift detection
ALT
Alerting

Audit & lineage

LOG
Immutable logs
UC
Unity Catalog
EVD
Evidence packs
LIN
Lineage

Access & policy

RBAC
Role-based access
PE
Policy engine
SEC
Secrets & keys

Frameworks

RMF
NIST AI RMF
EU
EU AI Act
42K
ISO 42001-aligned
27K
ISO 27001

The exact components are chosen per engagement - Sentinel is model- and framework-agnostic by design, so it can enforce a new control or map to a new regulation the day one lands.

Questions we get

Before you govern with Sentinel

Is Sentinel a product or a framework?

Both, in sequence. Sentinel is Focaloid's governance framework and the runtime components that implement it - guardrails, eval gates, observability, audit and access control. We stand it up around your AI with your team, then it runs in your cloud as part of the system, not as a service you ship your data to.

Can it govern AI we built ourselves, or third-party models?

Yes. Sentinel wraps any model or agent - Claude, open-weight, fine-tuned, or a third-party system - whether Focaloid built it or you already run it. It governs the AI without needing to own or replace it, which is exactly what makes an existing system review-ready.

How is this different from your AI Governance methodology?

Method versus mechanism. Our AI Governance methodology is how we decide whether an AI system is safe, fair and accountable - a nine-phase lifecycle with a go/no-go gate between each phase. Sentinel is the production-grade machinery that enforces those decisions at runtime and generates the evidence each gate needs. You use them together: the method sets the bar, Sentinel holds the system to it.

Which regulations and frameworks does it map to?

Sentinel is built around the NIST AI RMF and the EU AI Act first, is aligned to ISO/IEC 42001, and is delivered by an ISO/IEC 27001-certified team. Because the evidence is captured once and mapped to each framework, proving your controls in one place counts toward the others rather than starting over.

Does our data leave our environment?

No. Sentinel deploys inside your own cloud and security perimeter. Prompts, outputs, evaluations and the audit trail stay where your data already lives - nothing has to leave to be governed.

How long does it take to make an existing system review-ready?

For a system that's already live, wrapping it with guardrails, evals, observability and an audit trail is typically a matter of weeks, not quarters - because Sentinel is added around what you run rather than rebuilt into it. The first milestone is usually the evidence pack your reviewers have been asking for.

Have AI that needs to clear a review?

Bring us the system - one you're building or one that's already live. On a 30-minute call we'll map it onto Sentinel: the guardrails, the eval gates, the audit trail and the evidence your reviewers will ask for.

ISO/IEC 27001-certified · NIST AI RMF & EU AI Act-aligned · Deploys in your cloud