AI Governance & Trust Plane

• Classify. Data is labelled by type, sensitivity and personal-data content before any agent can reach it.
• Authorise. A consent and authorisation matrix defines which actions are permitted, per role and per user, revocably.
• Enforce. A deterministic gate allows, masks, returns metadata only, or blocks. Rules decide, not model judgement, so the answer is identical every time and can be audited line by line.
• Record. An action log captures what was done, on whose authority and under which policy version, written so a reviewer can read it rather than a developer.

The platform emits the readiness checklist, the data map and the registry entries as an output of running. Because the evidence is generated by the system rather than compiled by hand afterwards, it cannot drift away from what the system is actually doing.

For UAE federal entities this maps directly to the national readiness standard and its domain checklist. In regulated enterprise the headings differ but the substance does not, and the same controls satisfy both.

Classification itself is a commodity. You can buy it from Microsoft Purview, AWS Macie or a sovereign equivalent, and we do.

What is not a commodity is the policy that maps your classifications to permitted agent actions, the deterministic gate that enforces it, and the evidence it emits. We build those three. They are the reason our services pass review rather than stall in it.

What stops an AI agent doing something it was not authorised to do?
A deterministic enforcement gate rather than model judgement. Classification establishes what the data is before the agent reaches it, an authorisation matrix defines which actions are permitted for that classification, role and user, and the gate then allows, masks, returns metadata only, or blocks. Because the decision is rule-based, it produces the same result every time and can be audited.

How do you defend against prompt injection reaching a tool call?
In layers, on the assumption that injection will occasionally succeed at the language layer. Retrieved content is treated as untrusted data and never as instruction. Tools run under least privilege with their own scoped credentials, so a compromised prompt cannot reach a system the agent was never granted. Tool execution is sandboxed, secrets are isolated from the model context, and high-consequence actions require a human checkpoint. We red-team these paths before go-live.

Who is accountable when an agent makes a wrong decision?
Your organisation remains accountable, which is precisely why the action log matters. Every action records what was done, on whose authority, under which policy version, and whether a human approved it. That turns an incident from an argument into a review of a record.

How do you prove to an auditor what an agent did?
The action log is written for a reviewer rather than a developer, and the system emits an evidence pack containing the readiness checklist, the data map and the registry entries. Because evidence is generated by the platform rather than assembled afterwards, it stays consistent with what the system genuinely does.