For the CISO
AI governance that does not put a vendor in your traffic.
AI agents are being given credentials to production systems faster than access review can keep up. The governance layer for that should not itself become a new dependency in the path — or a new place your data goes.
The six questions, answered up front.
These are the ones that decide whether a governance tool is viable at all, so they are worth answering before anything else.
Where does the traffic go?
Agent, to a decision point inside your environment, to the tool. All of it within your network. FaburAI publishes the policy and is never a hop in the call.
What leaves the network?
Payload-free decision records, sent asynchronously. Request and response bodies never leave. Your data is governed by us and never handled by us.
What if you go down?
Enforcement continues on the last known good policy. An outage on our side neither opens governed tools nor stops your agents.
Do we open a firewall for you?
No. Policy is retrieved outbound and records are sent outbound. Nothing connects inbound to your environment.
How granular is access control?
User role and AI actor, down to the individual column, with deny overriding allow across the whole policy set.
Can we prove what happened?
Every governed call leaves a record naming the actor, the role, the target, the outcome and the rule that decided it, expandable to the full identity chain.
The risk is not the model. It is the credential.
An agent given access to a production system inherits whatever that access permits. Without governance in between, the effective blast radius of an agent is the blast radius of the service account it was handed.
Agents you did not approve
Anything calling a governed server identifies itself on connection, so an agent nobody registered appears as an observed actor rather than as ordinary traffic.
Access nobody declared
Access paths record whether they were declared, observed in real traffic, or approved. A path observed but never declared is the one to look at first.
Capabilities that changed
What each server exposes is fingerprinted, so a tool added quietly to a production server is a detectable event rather than a later discovery.
Governed at the column, shaped like the path.
Tool-level permission is a coarse instrument. It answers whether an agent may call an operation, not what that operation may reach on whose behalf.
Column-level, role-aware
A rule binds to the user role and the AI actor together, down to the individual field. Deny overrides allow, so a specific denial on a sensitive column cannot be widened by a broader permission written elsewhere.
Built from observed access
A rule can be built from a real path — this role, through this agent, to this server, tool and table — so the enforcement matches the access it governs instead of being a broad grant that happens to include it.
Least privilege is easy to write down and hard to keep true. Rules derived from paths that actually exist stay closer to it than rules written in the abstract.
No rule governs traffic until a person approves it.
Policies move through draft, review and approval before anything enforces, and the step that produces enforcement refuses whatever has not been approved. The gate is structural rather than procedural.
Approval is recorded
Who approved which rule, and when — available as evidence rather than as recollection.
Impact is measured first
A rule can run against production traffic without blocking, recording what it would have denied, before it is allowed to deny anything.
Rollout is per server
Enforcement mode is set on each server, so a change lands on one system at a time rather than across the estate at once.
Every decision is reconstructable.
A denial that cannot be explained is difficult to defend, and an allow that cannot be explained is worse.
The full chain, per decision
Identity provider, user role, AI actor, application, server, tool, table, column, and the rule that decided — on one screen, for any single call.
Which conditions matched
The conditions evaluated for a decision can be inspected, so an outcome can be explained rather than asserted.
We are glad to go through the architecture.
If it is useful, we can walk your security function through where traffic goes, what leaves the network, and what happens when we are unavailable.