OBEL Takes Longer. By Design. Here's the Math on Why That's the Point.

Every security review of OBEL eventually gets to the same question: does governing every request slow things down? The honest answer is yes. OBEL takes longer than calling a model directly, because it does more - it scrubs the prompt, classifies it against a sovereign schema, checks it against policy, routes it, and writes an audit record before the model is ever called. A platform that added zero latency would be a platform that skipped a step, and we don't think "faster" is a feature worth having if the thing it's faster at is not actually checking what left your network.

So rather than claim OBEL is somehow free, we measured it. What follows is the actual number for the part of the pipeline we control outright - the scrubbing and classification logic itself - compared honestly against how long a model call takes on its own, and against what the alternative actually costs when it goes wrong.

What we measured, and what we didn't

We're not claiming OBEL adds zero overhead end to end - authenticating the request, resolving the caller's tenant and policy, routing through the proxy, and committing the audit record all add real milliseconds on top of a bare API call, and some of that depends on network topology we don't fully control. What we can measure precisely, because it's pure in-process logic with no network call in the hot path, is the actual scrubbing and classification work: the part of OBEL's pipeline that decides whether a prompt contains something that shouldn't leave your network, and what it's allowed to touch.

We ran OBEL's scrubber and classifier directly, 500 times each, across five representative prompts - a plain request, one containing a social security number and an email address, one containing a live-looking AWS key, a code question, and a longer business document summary. Node's high-resolution timer, no network, no database, just the functions a prompt actually passes through before anything is decided.

Put plainly: the governance logic itself is a rounding error against the model call it sits in front of. Roughly a thousandth of one percent of total response time, in our measurement. That number is specifically for the scrub-and-classify compute - it does not include the proxy hop, tenant resolution, or the policy check, each of which adds a small, real amount on top. We're not hiding that. We're saying it doesn't change the conclusion.

What that time is actually buying you

The audit write doesn't even cost you that much of it. OBEL commits the governance record before the model call proceeds, but the GitHub-backed audit commit itself is dispatched after the response has already started streaming back to the user - the record is guaranteed, the user isn't waiting on it. What they are waiting on, for a few hundredths of a millisecond, is a decision: does this prompt contain something that needs to be stripped, is it classified above the level this org is allowed to send to a model, and does policy allow it through at all.

• Scrubbing - PII, credentials, and secrets identified and removed before the model ever sees the original text.
• Sovereign classification - every prompt assigned a protective marking, with anything above the approved ceiling hard-blocked before inference, not flagged after.
• Policy evaluation - the request checked against org-specific rules, not a generic default.
• A tamper-evident audit record - committed inline, not reconstructed later from logs that may or may not exist.

What skipping it actually costs

IBM's 2026 Cost of a Data Breach Report put the global average cost of a breach at $4.99 million - a new record, up 12% on the year before, and the highest the report has recorded in 21 editions.^[1] That's the baseline. It gets worse specifically where AI is involved without governance behind it.

Shadow AI incidents more than doubled as a share of breached organisations in the space of a year, from 20% to 43%, and AI-driven attacks now account for more than one in four malicious breaches - a 56% increase - adding roughly $1 million to the average cost of an incident where they're involved.^[1] Only 32% of breached organisations had an AI policy in place at all, and that number is falling, not rising.

“We could make OBEL faster by removing a check. We're not going to, and we'd be suspicious of anyone who tells you their governance layer is exactly as fast as not having one.”

- Denis Bouton

This piece was prepared by the OBEL editorial team at ninthLABS Ventures, drawing on an internal benchmark of OBEL's own scrubbing and classification logic and on IBM's publicly published 2026 Cost of a Data Breach Report.