Every AI use case. One security gateway.

6+

Model providers governed through one interface

100%

Of prompts classified before inference

Zero

Raw PII reaches any model, ever

Instant

Fallback to alternate model if primary is unavailable

Full embedded chat with model selector, Tools menu, Security Monitor, and ARGUS-i governance. Conversation list shows all threads in the space with counts and timestamps.

Every artifact generated in the space - documents, images, outputs - saved together and searchable by type. One place for everything the team has produced on this project.

Per-request run history. Model, tokens, cost, latency, which knowledge bases were queried, whether web search was used, and all ARGUS-i events - for every message ever sent in the space.

Total space spend, average cost per conversation, and a per-conversation cost breakdown. Budget visibility at the project level without needing to query org-wide analytics.

Decision Trace Ledger writes a structured governance record for every interaction before the model call. Export it on request. When the regulator asks, the answer is a query.

Agentic APM traces every tool call against MITRE ATT&CK. Quality and judge scores are applied to every run automatically. Worst-performing agents surface immediately.

Prompt Analytics and Model Arena give you quality, cost, and latency per version and per A/B variant. Improvement becomes measurable, not a matter of opinion.

CEF-format event streaming to Splunk, Sentinel, and QRadar. Cursor-based NDJSON polling API for direct SIEM integration with no additional instrumentation.

Decision Trace Ledger

Every interaction generates a trace written before the model call: classification level, PII rules triggered, sovereign block decision, scrubber output. The ledger is live, filterable by event type, and available for export. When a regulator, insurer, or auditor asks for evidence of AI governance - this is what you hand them.

Trace Patterns

Aggregates the ledger into a frequency view: which rules fired most, across how many interactions, how many distinct matches. In a typical 30-day window, PII:EMAIL leads by a wide margin - followed by CREDIT_CARD, AU_PHONE, and NER:PERSON_NAME. Most organisations are surprised by the volume.

MITRE ATT&CK Cyber

Every agent tool call is inspected against 17 MITRE ATT&CK technique patterns. Read-only tools are excluded from command-pattern matching to prevent false positives. The result feeds directly into existing security operations workflows.

Model Arena + Prompt Analytics

When A/B testing is enabled, every agent run fires Variant A and Variant B simultaneously. Quality score, independent judge score, cost, and latency are tracked per variant per version. Prompt selection becomes quantitative rather than subjective. No more arguing about which version is better.

Context Memory

After each completed agent run, OBEL extracts key decisions and summaries and stores them in the organisation's context memory. Future runs on matching topics receive that memory automatically. Agents improve with use - without retraining, without model access, without vendor dependency.

Context Router

Simple formatting tasks go to fast, cheap models. Complex reasoning and analysis tasks go to frontier models. The Context Router makes that decision automatically on every request based on task complexity - cutting compute costs without sacrificing capability.

Full governance pipeline on every CLI call

PII scrubbing, injection detection, ARGUS-i classification, and audit logging on every Claude Code, Aider, Gemini CLI, and Goose request.

OWASP code security scanning

Code sent to AI tools is scanned for hardcoded credentials, injection vulnerabilities, insecure patterns, and dependency risks before reaching the model.

Per-repository spend attribution

Every CLI request is attributed to a repository and developer. Spend, request volume, and security events are broken down by repo in the Intelligence Hub.

Identity-bound API keys

Each developer authenticates with their OBEL identity. Shared or leaked API keys cannot be used anonymously - every request is tied to a verified user.

58

controls mapped across four frameworks, each with the OBEL control, the requirement, and the audit evidence an auditor can verify.

What "audit evidence" means in practice

Each control shows the specific OBEL platform feature, the requirement it satisfies, and the evidence - log exports, configuration records, enforcement history - that an auditor can independently verify. Not a self-attestation. Verifiable evidence.

Native CEF 0 format

Events stream as RFC 5424-compatible CEF - no transformation required for Splunk HEC, Sentinel Logic Apps, or QRadar Universal DSM.

Cursor-based NDJSON polling

SIEM connectors poll GET /api/audit-stream with a cursor timestamp. Each response includes the next cursor. No missed events. No duplicate processing.

Severity-mapped per event type

sovereign_blocked=9, MITRE ATT&CK match=7, PII detected=6, agent failed=5. Standard SIEM severity scale so alert thresholds work without reconfiguration.

HMAC-signed authentication

Long-lived tokens scoped to your org. Generated in Settings - Communications. Rotate by changing AUDIT_STREAM_SECRET. No OAuth flow required for SIEM polling.

Available on STANDARD+

Enable from Settings - Governance - ARGUS-i. Requires vault configured. Toggle on; existing conversations are unaffected.