Complete inventory
Models, agents, applications, use cases, MCP servers, providers and data classes — including AI the central team did not build.
ENTERPRISE AI GOVERNANCE · MODELS · AGENTS · APPLICATIONS
Enterprise AI governance platform for models, agents and applications.
Give each AI system an owner, a risk assessment and an approval record. Connect that record to runtime policy and evidence in your own infrastructure.
Customer-hosted on Kubernetes, in your cloud or on premises. For enterprise teams managing AI across business units.
In the demo: See how one AI use case connects ownership, approvals and runtime policy.
Or email sales@kosmoy.com.
Inspect the control boundary
Follow one policy from approval to operational evidence.
Use an example customer-support assistant as the review subject. Its use-case approval, request-path policy and evaluation findings should refer to the same system and accountable owner.
Worked governance review — illustrative evidence chain
| Decision | Inspectable evidence | Boundary |
|---|---|---|
| Approve a use case | Named owner, permitted purpose, risk rationale and approved deployment scope in the registry. | A completed record documents a decision; it does not enforce every behavior of the application. |
| Enforce an approved policy | Configured gateway route plus a permitted and a denied request with their outcomes. | Runtime enforcement applies to the requests routed through the configured control. |
| Review a change | Versioned evaluation cases, thresholds, errors, reviewer notes and a rerun after remediation. | A generated report supports human review. It does not certify legal compliance or replace the existing GRC program. |
Keep the existing system of record for privacy, supplier risk or formal audit work where it serves that job. Define how Kosmoy's registry and runtime evidence will be reviewed alongside it; validate any export or integration before promising automated synchronization.
Follow one use case from intake to runtime evidence
Bring one AI use case and the policy that applies to it. We show its registry record, an allowed and a denied call through the gateway, and the evidence each step leaves.
Read the reproducible evidence walkthroughA business unit wants to deploy a customer-service assistant. Your governance team needs to know who owns it, which models and tools it uses, what data it can access and who approved the risk. Kosmoy connects those decisions to the AI inventory and the controls applied in production.
Start with inventory, ownership and approvals. Add gateway controls for traffic routed through Kosmoy and Action Capsules for contained agent workloads. Coverage depends on the systems you connect and the policies you configure; a registry entry alone does not enforce runtime policy.
Enterprise buying criteria
Six capabilities an enterprise governance platform should connect.
A vendor can call a registry, a gateway or a compliance workflow “AI governance”. The buying test is whether the platform connects the full chain from discovery to runtime consequence and evidence.
Accountable ownership
A named business owner, technical owner, approval state and lifecycle for every AI system and agent.
Risk and obligations
Repeatable classification by use case, role, autonomy and data sensitivity, linked to the controls that follow.
Policy and approvals
Approved models, tools, data access, budgets and human-review gates expressed as enforceable policy rather than guidance.
Runtime enforcement
Identity, guardrails, routing, budgets, tool access and containment applied while calls and agent actions are happening.
Continuous evidence
Every decision and exception recorded with system, actor, time and outcome and mapped into framework-specific evidence.
From inventory to runtime consequence.
The control plane sits between the enterprise record and the live AI estate. Policy becomes useful only when it changes what a model or agent is allowed to do.
What the enterprise runs
AI use cases
Business purpose, owner, users and expected outcome
Models and applications
Hosted models, private models, copilots and RAG systems
Agents and tools
Agents, MCP servers, APIs and systems of record
Kosmoy governance control plane
01
Inventory
Know what exists
02
Ownership
Make accountability explicit
03
Risk
Classify systems and data
04
Policy
Approve models, tools and actions
05
Runtime
Enforce on every live call
06
Evidence
Keep the audit record current
What the enterprise gets
Approved access
The right model, tool or agent is available to the right workload.
Policy action
Risky calls are blocked, redacted, routed for approval or contained.
Audit evidence
Every decision, override and runtime event remains attributable.
Commercial clarity
Scope the platform around the governance problem
Commercial scope depends on which control layers are required and where they run. A registry-and-compliance deployment is different from a full runtime control plane with gateways and contained agents.
The main sizing factors
- Modules and governance layers selected
- Number and scale of governed AI workloads
- Cloud, on-premises or isolated deployment boundary
- Support, assurance and implementation requirements
Module questions, answered straight.
What is an enterprise AI governance platform?
An enterprise AI governance platform connects six jobs that are often split across spreadsheets and point tools: inventory every AI system, assign accountable owners, classify risk, define approval and access policy, enforce that policy on live AI traffic, and keep the evidence current. Kosmoy does this for models, agents, applications, MCP servers and AI use cases in one control plane.
How is an AI governance platform different from an AI gateway?
The gateway is the runtime policy point: it authenticates, guardrails, routes, budgets and logs live AI calls. The governance platform is broader. It also contains the registries, ownership, use-case approvals, risk classification and compliance evidence that tell the gateway what policy to enforce and prove what happened afterwards.
Does Kosmoy govern AI agents as well as models and applications?
Yes. The Agents Master Registry inventories agents across Azure AI Foundry, AWS Bedrock, Google Vertex AI, Salesforce, ServiceNow and private runtimes. Gateway policy applies to agent traffic that routes through Kosmoy, while Action Capsules add runtime containment, short-lived credentials and a kill switch for high-autonomy agents.
Which governance and compliance frameworks does Kosmoy support?
Kosmoy maps the same operational evidence to the EU AI Act, ISO/IEC 42001 and NIST AI RMF. Frameworks change the control mapping and evidence export; the underlying inventory, classification, approvals and runtime event record remain the same.
Can Kosmoy be deployed on-premises or in a private cloud?
Yes. Kosmoy runs single-tenant in the customer's Kubernetes on Azure, AWS, GCP or on-premises, including isolated environments. Models can be public, private or self-hosted. The enterprise keeps the control plane, prompts, responses, logs and credentials inside its chosen boundary.
What evidence does the platform keep for an audit?
The record includes system and agent ownership, risk classification, approvals, model and tool access, policy decisions, guardrail events, overrides, cost, human review and lifecycle changes. Each event remains attributable to a system, actor, time and outcome and can be exported into framework-specific evidence bundles.
Enterprise proof
Built for environments where AI cannot become another unmanaged SaaS silo.
Kosmoy works with regulated and operationally critical organizations, including Banca d’Italia and Leonardo.
- Runs in your Kubernetes
- Azure · AWS · GCP · on-prem
- LLM · MCP · A2A
- No mandatory vendor-hosted control plane
Map your AI estate to enforceable governance.
Bring one real model, application or agent estate. We will walk from inventory and ownership through policy enforcement and audit evidence.
Or email sales@kosmoy.com.