AI risk governance,
built for the way your
organization actually ships AI.

In SaaS mode, content is processed in-memory to make a policy decision — only the decision and metadata are persisted to the Audit Log. Private and on-prem deployment options are available for enterprise customers; talk to a solutions engineer about your requirements.

Inspection runs on the request path, so it adds some latency — how much depends on which detectors are enabled for your policy. We're happy to benchmark your specific configuration during a pilot.

Gateways route traffic. Obiguard governs it. We sit in front of your gateway or SDK and add the policy enforcement, violation tracking, review workflow, and audit trail that routing tools leave out of scope.

Five today. NIST AI RMF 1.0 and ISO/IEC 42001:2023 are what a multinational customer or auditor will ask for — the second is the only certifiable standard in the set. The OWASP Top 10 for LLM Applications (2025) is the security list your penetration testers already work from. AISCF is Malaysia's AI Systems Cyber Security Framework, published by NACSA: 42 security activities organised across a seven-phase system lifecycle, from Inception through Operation & Monitoring to Retirement.MGF for GenAI is Singapore's Model AI Governance Framework for Generative AI, from IMDA and the AI Verify Foundation — nine dimensions, of which four are ecosystem commitments aimed at model developers and policymakers rather than deployers, so that score is capped at 56% by design. Coverage is estimated from your own platform activity, category by category, as a self-assessment aid for audit preparation — not a certification. See what each framework asks for →

Project Moonshot is AI Verify Foundation’s open testing toolkit for LLMs. Obiguard runs its catalogue of cookbooks and recipes — safety, bias, jailbreak resistance, privacy leakage, and capability — plus its red-teaming attack modules, against the AI Agents you have registered. Pick a target and a system prompt, run the benchmark, and every recipe comes back graded and retained as governance evidence. Grading scales differ per recipe (some invert, some band into risk levels), so we always render the grade alongside its scale rather than a bare score.

A job runs at 03:00 UTC each day and randomly samples roughly 17% of the previous day’s traces. Each sampled trace is scored 0–100 against six LLM judge criteria — toxicity, demographic bias, sentiment consistency, fairness, misinformation, and privacy leakage. Anything scoring under 60 on any evaluator is flagged for review. It runs asynchronously and never blocks live traffic, and the report shows a 30-day trend, per-agent scores, and drill-down into every flagged trace.

Criteria define what triggers a policy event — a detector match, a keyword, a model call outside scope. Policy Sets group Criteria and assign them to AI Agents, with an action (block or flag) and an optional route to the Review Queue.

Violations that need human judgment — edge cases, high-risk content, new agent behaviour — are routed to the Review Queue. Reviewers can annotate, approve, or escalate, and every decision is written to the Audit Log.