Neural Inverse Govern / Shared services
Secrets, keys, sandboxes and assistants, held to the same rules as everything else.
The services under Neural Inverse Build and Govern alike: a vault, per-organisation keys, DLP, gateways for MCP tools and remote agents, sandboxes, data residency, the console assistant and harness packs.
- Vault
- Write-only secrets, dynamic credentials
- Keys
- Per organisation, versioned and rotated
- Sandboxes
- Isolated Firecracker runtimes
- Assistant
- Off by default, acts as the person
- Harness packs
- Signed and gated on evals
Overview
Shared services are the parts of the platform both products rely on. Secrets live in one vault and are never returned in plain form, data is encrypted under each organisation's own keys, one DLP engine applies across models, tools, agents and context, and sandboxes, the console assistant and harness packs are governed by the same identity, policy and audit as everything else.
What it does
What the shared services provide.
Only the services that are working today.
Vault secretsVersioned key-value secrets, shared per mount at use, read and write levels. Every vault request is written to the audit log.
Dynamic credentialsShort-lived credentials for databases, AWS, Azure and Google Cloud, a PKI and SSH certificate authority, and transit encryption, with leases you can renew and revoke.
Machine loginsWorkloads sign in to the vault with AppRole, client certificates, JWT, Kubernetes service accounts or a Govern agent's identity, instead of a stored token.
AI keys behind placeholdersAgents use AI provider credentials through placeholders that are replaced on the way out, so the real key never reaches the agent.
Secrets into sandboxesSecrets pushed into a sandbox or workspace land only in memory-backed storage, and only for people who may use both the secret and the target.
Encryption keysPer-organisation keys, versioned and rotated, sealed by a deployment master key kept outside the database. Data is encrypted with AES-256-GCM under per-object data keys.
One DLP engineBuilt-in and custom patterns, applied on model prompts and answers, MCP tool calls, agent-to-agent traffic, context sources and app activity, with the action set by the data's classification.
MCP gatewayA reviewed catalog of MCP servers and tools, assigned to the organisation, teams or projects. The gateway applies assignment, DLP and rate limits, holds calls that need approval and logs every decision.
Agent gatewayRemote agents reached over the Agent2Agent protocol, with deny-by-default allow rules, credentials held in the vault, a classification ceiling, a delegation depth limit and DLP in both directions.
SandboxesIsolated runtimes for agent and user work, started from templates within your organisation's limits and each member's quota, with exec, files, logs and an MCP endpoint agents can drive.
Approved artifactsWhat a sandbox run produces is encrypted at rest and approved or rejected before it is applied. An administrator can stop every sandbox of the organisation at once.
Data residencyGovern runs where you deploy it. Models can be pinned to regions and limited by classification, a project's residency rule refuses models outside it, and every audit entry records the region that wrote it.
Console assistantAnswers questions about your organisation in the console, with no identity of its own: every tool call runs as the signed-in person, models are reached only through the AI Gateway, and every answer cites its records.
Assistant proposalsThe assistant drafts a fixed set of changes, such as creating a project or binding a role. Each runs only when the same person confirms the exact request within five minutes, once, through the target's own checks.
Harness packsSigned developer-experience packs for the Editor's agent engines: instructions, skills, tools, MCP servers and evals, assigned to the organisation, teams or projects. Packs are not policy and cannot weaken it.
Experiments and rolloutA/B experiments between pack versions with staged rollout, gated on passing evals, with outcome metrics made of identifiers and counts only, never code or prompts.
How it works
How a change drafted by the console assistant runs.
The assistant can propose a change. Only the person can make it.
- AskA person asks in the console; the assistant reads records through Govern's API as that person.
- DraftIt drafts one of a fixed set of changes, stored as the exact request.
- Pre-checkThe request is checked as the person; a failed check disables the card.
- ConfirmThe same person confirms it in the same session within five minutes.
- RunIt runs once, through the target route's own checks, MFA and two-person rules included.
- RecordThe audit entry carries the proposal id, so auditors can tell it from a typed change.
Who uses it
Built for every role that answers for AI.
Platform engineersRun the vault and sandboxes, and publish and assign harness packs.
Security teamsManage keys and DLP patterns, review MCP servers and set allow rules for remote agents.
Developer experience leadsRun experiments between harness pack versions and promote the one that performs.
AdministratorsTurn on the console assistant, choose its models and set how long transcripts are kept.
Enforced and recorded
Held to the same rules as everything else.
Each service enforces its own boundary on the server and writes to the same audit log.
Enforced
SecretsAI provider keys and other credentials are write-only: responses show only a hint, a version and the rotation time.
MCP and agent callsDecided in the gateways for every call: assignment or allow rules, DLP, rate limits and approvals.
AssistantCan never see or do more than the person using it. Deletes, credentials, billing and anything that sends data to an address are never proposed.
Harness packsThe Editor refuses unsigned or tampered packs, and agent policy always wins over anything in a pack.
Recorded
Vault and gatewaysEvery vault request, and every MCP gateway decision with its latency, DLP findings and approval.
Assistant turnsOne audit event per turn with a keyed hash of the prompt, never the prompt itself. Transcripts are encrypted under the organisation's key for the retention you set.
Pack changesPack, version, assignment, experiment and eval changes, inside the transaction of the change.
The server can use Go's FIPS 140-3 cryptographic module and refuse to start without it. Whether this meets a validation requirement is for you and your assessor to decide.
Master keyThe deployment master key that seals every organisation's keys is kept outside the database by your operator.
SandboxesRun on compute you operate, as part of your own installation.
Air-gappedThe console assistant uses local models served by your gateway only; if no model passes its conformance check, it stays off.
Hosted by usWe run it for you. Custom harness packs and experiments depend on the plan; a self-hosted installation includes everything.
Get started
Set it up with the documentation.
Talk to our team.
Neural Inverse is available by request. We work with your engineering, security and procurement teams from the first conversation.