Public sector and healthcare
It runs air-gapped, the source is readable, and the vendor receives nothing — which is most of an assurance pack already.
On this page
What is already on you
- 01
Data has to stay where you said it would stay
Residency and sovereignty commitments are made to citizens and patients, not to a procurement panel. Egress here is allowlisted rather than merely configurable, goes only to endpoints somebody in your organisation configured, and a per-agent policy can require a serving region — enforced on the fallback chain as well as the primary route, and refused rather than downgraded when no route qualifies. - 02
Safety requires a stop that somebody owns
A kill switch scoped to one agent, a team or everything, requiring an attributable actor and a reason, evaluated first in the request path so it beats every other gate. It is the literal implementation of the stop capability the regulation asks a deployer to have, and it is the control a clinical safety officer will ask about first. - 03
Procurement asks what happens at exit before it asks what happens at go-live
Records — traces, events, audit entries, approvals, policies, registry records and exports — may be retained and used indefinitely including after termination, on the stated reasoning that the software is bought to produce that evidence — which is the drafted licence position, not yet a counsel-approved one, so it belongs in the contract you sign. The other half is yours: there is no supplier-side copy, so an exit plan that assumes one would fail. - 04
Staff are already using tools nobody procured
The shadow-AI radar reconciles five evidence sources — vendor bills, network egress, service-account key audits, developer tool telemetry, and the gateway’s own caller and price consistency checks — and it consumes feeds from the security stack you already run rather than inspecting the network itself. The boundary is explicit: findings tell you those agents exist, and chasing them down inside your organisation is your work. - 05
The obligations arrive on a fixed timetable
High-risk deployer duties phase in through 2026 and 2027, and the argument for starting now is arithmetic rather than urgency: retrofitting logging onto agents that have been running ungoverned for a year is the expensive path, because the year you most need to evidence is the year nobody recorded.
The objections, in the words they are raised in
Not a marketing FAQ. These are the sentences this reader says out loud in a first call, quoted rather than softened, and several of the answers below concede that the limitation is real and name the person who has to accept it.
- 01· asked
Can it run with no internet connection at all?
answeredYes, with two details worth knowing before you disconnect. A prebuilt image has no runtime dependency on a supplier service or a content delivery network and the console bundles its assets, so the running system reaches nothing you did not configure — but building from source still needs the pinned base image, the Debian packages and the npm dependencies, so mirror those registries or import a verified release image first. The model price catalogue ships with the product and loads on every boot, so an offline install meters from the first request; there is no price write endpoint, so correcting a price offline means editing the row directly, and boot-time loading is additive so your change is not overwritten on restart.
- 02· asked
We cannot procure uncertified software for a critical service.
answeredThen do not, and the product’s own documentation agrees with you. Broad general availability is currently a no-go decision, the published pilot boundary is one self-hosted deployment, roughly five to fifty agents owned by one platform team, and explicitly a non-production-critical evaluation before any workload whose outage would harm citizens or regulated operations. There is no certification, no independent penetration test and no availability commitment. What can be written into an agreement is a named date for the certification milestone your process requires, and a design partnership that gives you a named engineer, the real defect list rather than a sanitised one, and the right to publish anything your own test finds.
- 03· asked
What happens to our evidence if the supplier disappears or we stop paying?
answeredThat is what the terms are drafted to give you, and you have the source. The published licence provides that records may be retained, exported and continue to be used indefinitely including after termination, on the reasoning that losing the evidence at the end of a subscription would defeat the purpose of buying it, and it also covers reading, compiling and modifying the source for your own internal purposes, including remediating defects, with the modifications you make owned by you. Read all of that as intended commercial terms rather than a settled instrument: the file carries a banner saying it requires review by counsel in England and Wales before it is relied upon and still has placeholders in it, and counsel approval is one of the gates a design partnership has to pass. The practical dependency is on you rather than the supplier: there is no supplier-side copy of anything, so if the database file is lost and no backup exists, the traces and the chain are gone.
- 04· asked
Staff are using AI assistants on managed devices. Does this govern those?
answeredNot to the standard you would want for a device you do not control, and that limitation is published rather than sold around. Endpoint seat governance — hooks for developer assistants, signed fail-closed local bundles pushed by device management, the same roles, policies and kill switches as agents — exists as a preview surface flagged as not production-eligible: the hook is an unsigned command rather than a signed native binary, its replay bound depends on a clock the governed party controls, and its local spool is unsigned. No claim is made that it equals an inline network gateway on an unmanaged device. Buy this for governed agents; treat the seat surface as an experiment.
If the objection that would actually decide this for you is not one of the ones above, that is the more useful question, and it is the one worth sending.
Talk it throughRunning it where the network does not reach
Air-gapped or on-premise is one of five documented deployment modes, and nothing about the artifact changes between them — only where it runs and which egress it is permitted. That matters more for an assurance pack than it sounds, because it means the thing your team reviews in a connected test environment is the same image that runs in the isolated one.
The verification path is short enough to be done during the review rather than promised in it. List every outbound call site with one search over the server source; list every hard-coded URL with a second over the server and governance packages; run it with egress allowed only to your own endpoints and confirm nothing is blocked; read the dependency list, where the package holding the entire governance domain has zero runtime dependencies and the server’s own list is short enough to read in full — count it in the manifest and against the release software bill of materials rather than against a figure in a document, because the documented count is behind the manifest at the time of writing. The only supplier-owned string in the source is an attribution header sent to a model router rather than a destination, and it is disclosed.
Two operational facts belong in the runbook rather than the brochure. Inbound, the process speaks plain HTTP and manages no certificates, so your own terminator does TLS and must not buffer responses or streaming breaks. And the metrics endpoint follows Prometheus convention by being unauthenticated while exposing agent identifiers and month-to-date spend, so it belongs on the monitoring network and nowhere else.
- Egress is allowlisted, not merely configurable
- Two lists constrain which hosts a provider row may name and which environment variables it may reference, and neither may be empty. Narrowing them is what stops an administrative registry write from becoming a read of every secret in the process. Registered tool servers and webhook receivers carry their own host and credential-name pairs; the tool-server pair defaults to loopback only and guards the sharper primitive, because that credential is sent onward raw.
- Anchors can be written to a file
- The audit anchor sink can be a local file, which makes no network call at all — so an isolated deployment can still hold off-box evidence, provided the copy lands somewhere the database administrator cannot rewrite.
- Identity stays yours
- Sign-in is authorisation code with PKCE against your own issuer; no offline scope is requested and no refresh token is held, so nothing persisted could be replayed against your directory. No group claim can promote anyone in the console.
Evidence you keep, and a supplier you can leave
The compliance mapping is the part a public-body assurance process can use directly, because it is written clause by clause and it declines to claim what it cannot. Automatic recording over the system’s lifetime maps to the flight recorder and the hash-chained governance log, with the explicit note that hidden model reasoning is not recorded. Human oversight maps to approvals with named approvers and recorded rationale. The ability to halt maps to the scoped kill switch. Use in accordance with instructions maps to a declared purpose that is required at agent creation rather than optional. Assigning oversight to competent persons maps to a named human owner per agent rather than a team mailbox.
The inventory clause is the one worth arguing in a governance board. An AI system inventory maintained beside the runtime is updated by whoever remembers, while the runtime is updated by whoever ships. Here the registry is the same record the gateway resolves on every request, so it cannot silently drift from what is actually running — which is a structural claim rather than a process promise.
On exit, the licence is unusually explicit: records survive termination and may be exported and used indefinitely, source may be read, compiled and modified for internal purposes, and modifications you make are yours with no obligation to disclose them. Licence compliance is self-certification, because the software reports nothing to the supplier — one written certification a year on notice, no right of inspection, no metering component. Read the licence as intended commercial terms rather than a settled instrument: it carries a banner saying it requires legal review before it is relied upon, and counsel approval is one of the gates a design partnership has to pass.
The agents nobody registered, and the honest boundary around them
The radar is reconciliation rather than inspection, which is why it works in an organisation that already owns a security stack. Five evidence sources: vendor bill reconciliation, network egress analysis, service-account key audit, developer tool telemetry, and the gateway’s own caller and price consistency checks — including an hourly roll-up of credentials presented at the door and rejected, so an unrecognised credential in circulation becomes a finding rather than a log line nobody searches for.
The integration direction is the security argument. Token Observe holds no credential into your security stack: your gateway, proxy or SIEM pushes evidence to it, which is both the shorter security review and the smaller blast radius, because the worst a compromised install can do to your SIEM is stop receiving from it. Two pull connectors exist and are the exception rather than the pattern.
The boundary is published in the support terms rather than discovered in a renewal conversation: agents that never route through the gateway are outside what the product covers. Findings tell you they exist; chasing them down inside your organisation is your work. That is a fair division, and it is worth setting the expectation with a governance board before the first radar report lands on it.
The parts of the platform this leans on
In the order they matter to this reader rather than the order the platform argues them, and each one carries its own stated limit on the page it links to.
Agent registry
One record per agent, and it is the record the gateway enforces against.
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Flight recorder
Every governed request in a timeline a compliance officer can read, and a search box that never writes SQL.
Audit chain
Every administrative act hash-chained; seal it under a key held off the box, and anchor it with a signature your auditor can check alone.
Shadow AI radar
Five evidence sources for AI activity that never touched the gateway, and a coverage model that refuses to call a dead feed a clean estate.
Does patient or citizen data ever leave our network?
Only to endpoints somebody in your organisation configured, and only after policy evaluation and redaction. The complete list is your model providers, your registered tool servers, your webhook receivers, your identity provider during a human sign-in and your anchor sink — plus one public price catalogue that an administrator triggers by hand and that sends no prompt, trace or identifier. There is no default egress. If your network policy permits outbound connections only to your providers, tool servers and webhook receivers, the product functions completely, and the supplier receives nothing in any configuration.
How does this help with an AI system inventory?
The registry is the inventory, and it is the same record the gateway enforces against on every request rather than a report generated from it — which is the only structural reason an inventory cannot drift from reality. Four fields are required to create an agent: name, owner email, team and declared purpose. Risk tier, lifecycle status, budgets, rate limits, data policy and metadata sit alongside them, and the metadata field is where an impact-assessment reference lives so it travels into recertification snapshots and exports rather than staying in a spreadsheet.
Who signs off the residual risks in a public body?
Whoever your governance requires, and the product tells you which risks need signing rather than leaving you to find them. The threat model names, per risk, the role that must record a dated acceptance — the CISO for heuristic injection detection, tamper-evidence rather than tamper-proofing, the unauthenticated delegated-principal header, snapshot group claims, absent multi-factor on local accounts and long-lived agent credentials; the Data Protection Officer for regex-based personal data detection; the Head of Product for provider data-policy flags being unverified operator assertions; the engineering lead for single-writer storage. Nine risks, four roles. None counts as accepted until a named person dates it, and anything not on the list and not mitigated is treated as a finding.
What support model comes with it?
A design-partner arrangement rather than a support desk: a named engineer, response targets in writing, roadmap influence, early access to fixes, per-release software bills of materials and checksums, and the real defect list published rather than shared under embargo. Hours are UK business hours with no out-of-hours cover, and response targets are response rather than resolution. One severity definition is worth noting for a governance board: a deployment serving traffic happily but no longer recording it is a severity one here, because the product exists to produce that record — most agreements would call that a low-priority ticket.
Is a natural-language search over prompt evidence safe to give a governance team?
It is bounded in the two ways that matter. The model translates a question into a validated filter object and never into SQL, the interpreted filter is shown back as editable chips, and the signed-in user’s team predicate is applied after translation where the model can neither supply nor remove it. It degrades to a deterministic keyword parser whenever the translation does not come back — no model configured, a timeout, an unreachable provider, or output that fails validation — so a failed translator narrows the search rather than breaking it. Sensitive list, search and detail reads append attributable audit events, so who read the prompt corpus is itself part of the record.
Bring the objection that is not on this page.
Write to hello@tenhaw.com with what your agents do, which providers they call and what would have to be true for you to put something in front of them. James Rooney replies. You will get a straight answer about whether Token Observe fits, including when it does not.
no form · no qualification step · no sales desk · the other three ways in