ArchitectureHow Obiguard works — from request to ledger

One inspection layer.
Every model your
org touches.

Obiguard sits in front of your AI calls as a lightweight proxy. Every prompt, response, and tool-call passes through the inspection pipeline — where policy is evaluated, violations are surfaced, and evidence is written to the ledger.

01 / The Proxy

Drop-in. No model changes.

Obiguard speaks the same API as OpenAI, Anthropic, Bedrock, Vertex, and Azure OpenAI. Point your existing SDK at our gateway — nothing else changes.
STEP 01 · ROUTE

Your SDK, unchanged

Set OPENAI_BASE_URL (or the equivalent for Anthropic, Bedrock, Vertex) to your Obiguard gateway endpoint. All existing code continues to work.

# one env var
$ export OPENAI_BASE_URL=
  https://gw.obiguard.com/v1
→ traffic now flows through Obiguard
STEP 02 · INSPECT

Inline inspection pipeline

Each request and response passes through the inspection pipeline: PII detection, injection classifiers, tool-scope checks, and your custom Policy Sets — all evaluated before the call completes.

prompt → inspect → allow
response → inspect → redact
tool-call → inspect → block
p50 added latency: 18ms
STEP 03 · ENFORCE

Policy decision & action

If a violation matches a Policy Set, Obiguard takes the configured action — block, redact, flag, or allow with log. Violations route to the Review Queue for human sign-off when configured.

policy_set: no-pii-in-responses
action: block
review_queue: true
→ written to audit log
02 / Platform Components

What's inside the platform.

Each component is independently useful — together they give you complete visibility and control over every AI agent in your organisation.
GATEWAY

Inspection proxy

A lightweight HTTP proxy that speaks OpenAI, Anthropic, AWS Bedrock, Google Vertex, and Azure OpenAI. Evaluates each request and response against your active Policy Sets before forwarding. Adds ~18ms p50 latency.

POLICY ENGINE

Policy Sets & Criteria

Policy Sets group enforcement rules (Criteria) and are assigned to specific AI Agents. Each Criterion defines a detector, a direction (prompt or response), and an action. Criteria are versioned and can be promoted or rolled back independently.

VIOLATION PIPELINE

Violations & Review Queue

Every policy breach creates a Violation record with the full event context. Violations can be auto-resolved or routed to the Review Queue for human annotation. All decisions are written to the Audit Log.

REGISTRY

AI Agents & Use Cases

A project-scoped registry of every AI Agent and Use Case your team has defined. Agents are linked to Policy Sets — ensuring enforcement follows the workload. Use Cases capture the business intent behind each agent.

LEDGER

Audit Log

An append-only record of every prompt, response, tool-call, and policy decision. Timestamped and exportable. Stream to your SIEM (Splunk, Sumo Logic, custom webhook) or export a signed manifest for auditors.

GOVERNANCE

Controls & Criteria

Org-level Controls define what behaviour is prohibited or required. Each Control maps to one or more Criteria and to external frameworks — NIST AI RMF, EU AI Act, ISO 42001, SOC 2 CC6/CC7, and HIPAA.

03 / Integrations

Works with your existing stack.

Obiguard is complementary to your AI gateway, not a replacement. It adds the governance layer that routing tools leave out of scope.
AI PROVIDERS

Any OpenAI-compatible endpoint

OpenAI, Anthropic, AWS Bedrock, Google Vertex AI, Azure OpenAI, and any self-hosted model behind an OpenAI-compatible API. No special SDK required — just change the base URL.

OpenAI · Anthropic · Bedrock
Vertex AI · Azure OpenAI
+ any OpenAI-compatible host
SIEM & EVIDENCE

Stream to your security stack

Audit Log events stream in real time to Splunk, Sumo Logic, Panther, or any custom webhook. Export signed manifests for SOC 2, HIPAA, and ISO 42001 audits without manual evidence collection.

exportsplunk · stream
exportsumo logic · stream
exportcustom webhook
+ signed PDF manifest
04 / Deployment

SaaS, VPC, or air-gapped.

Obiguard runs wherever your data needs to stay. In-memory processing in SaaS mode means content is never stored — only the policy decision and metadata reach the ledger.
SAAS

Hosted by Obiguard

Connect in under 30 minutes. Content is processed in-memory and never stored. Only policy decisions and metadata are persisted. Ideal for teams that want governance without infrastructure overhead.

VPC

Deploy in your cloud

Run Obiguard inside your AWS, GCP, or Azure VPC. Your data never leaves your perimeter. We ship a signed Helm chart — your team owns the deployment, we own the updates.

AIR-GAPPED

Fully isolated environments

For regulated industries that require zero outbound connectivity. Obiguard ships signed images and policy bundles with no external dependencies. Available on Enterprise plans.