Start from the objection you were going to raise.
- Roles, each answering the objection it raises
- 5
- Sectors, argued from the regime not a case study
- 3
- Objections answered in the words they are asked in
- 25
- Reference customers cited, because there are none yet
- 0
- OpenAI
- Anthropic
- Google Gemini
- OpenRouter
- Amazon Bedrock
- Azure OpenAI
- Your own endpoint
Cloud setup offers OpenAI, Anthropic, xAI and Google. Use separate billing and inference credentials.
By role
Start with the work you own: the AI estate, security review, data protection or day-to-day operations. Each page sets out the relevant controls and questions.
IT leadership
Know which teams use which AI tools, what they cost and who approved them.
“What is this going to cost us?”
Security leadership
Six residual risks name you as the person who accepts them. All six are published before you ask.
“You have not had a penetration test.”
Platform engineering
One base URL changes. The fail-closed trade is the thing to decide before you change it.
“If this is down, my agents stop. Why would I put it in the path?”
Compliance and internal audit
Every mapping says this feature helps evidence that clause. None says installing it makes you compliant.
“Does installing this make us compliant with the EU AI Act?”
Data protection
The retention default is keep forever, and that is a decision you have to make rather than inherit.
“Is your redaction sufficient?”
By industry
Explore the controls and evidence relevant to your sector. These are proposed uses based on the risks and requirements; there is no reference deployment yet.
Financial services
A refund is the reference case because an API returning 200 is not proof the customer got their money.
“We already run an LLM gateway with quotas, budgets and cost dashboards.”
Insurance
A claim decision an agent influenced has to be reconstructable years later, by somebody who was not there.
“Our agents only propose and a human always decides. Why add a control?”
Public sector and healthcare
It runs air-gapped, the source is readable, and the supplier receives nothing.
“Can it run with no internet connection at all?”
Cloud custody and optional customer-hosted controls are described separately. The 24 limits we publish, and the 9 risks a named person has to accept in writing, are on one page.
What we do not claimWhich of the eight is you?
Create a cloud account and workspace. No card or server installation. Model calls and Google BigQuery scans can incur separate provider charges.