05Control

Guardrails your teams can ship with.

Decide which models and tools AI may use, how much it may spend and which actions need a person. Then prove what happened with an audit log nobody can edit.

Start free trial Read the policies docs

{  "name": "Production model allowlist",  "type": "model_allowlist",  "scope_type": "environment",  "scope_id": "production",  "rules": {    "models": [      "gpt-5",      "gpt-5-mini",      "gpt-5-nano"    ]  },  "enforcement": "monitor"}

02App calls model "gpt-4o"

200 OK

HTTP/1.1 200 OKX-AIW-Model: gpt-4o # nothing is blocked; the span records:aiw.policy_id = <id of this policy>aiw.violation = "model_allowlist"

HTTP/1.1 403 Forbidden{  "error": {    "message": "model \"gpt-4o\" is not in the allowed models of policy \"Production model allowlist\"",    "type": "permission_error",    "code": "model_not_allowed",    "param": null,    "aiw_request_id": "req_…"  }}

Example policy. The response bodies are the gateway’s contract.

Ten policy types, one way to scope them.

Scope any policy to the organization, a workspace, an environment, a team, a workflow or a single agent. Changes reach the gateway within seconds, with no redeploy.

Tool allowlists, tool approvals and model‑access approvals are included in Pro, Business and Enterprise, and in the trial. Every other policy type is available on every plan.

Policy types
Type	What it does	When enforced
`model_allowlist`	Only the listed models may be used	`403 model_not_allowed`
`model_denylist`	The listed models may not be used	`403 model_not_allowed`
`spend_limit`	A daily or monthly budget with alert thresholds	`402 budget_exceeded`
`token_limit`	Tokens per request and per day	`403 token_limit_exceeded`
`rate_limit`	Requests per minute	`429 rate_limited`
`action_approval`	Sensitive models need a person’s approval	`403 approval_required`
`tool_allowlist`	Which tools an agent may declare or call	`403 tool_not_allowed`
`tool_approval`	Tools that need a person’s approval before they run	The approval is requested first
`data_capture`	Forces a stricter capture mode	Capture is downgraded
`end_user_quota`	Per‑user limits from the plans of your own app	`429 end_user_quota_exceeded`

Monitor or enforce, per policy.

In monitor mode violations are recorded and nothing is blocked. Simulate a policy against recent traffic to see what it would have blocked, then enforce it. Every revision is kept and audited.

1. Each policy with its type and scope.
2. Enforce or Monitor, set per policy.

Policies list with type, scope and enforce or monitor mode — Governance · Policies · sample data from the built‑in demo organization

Approvals, where the risk is.

Some actions should wait for a person. Approvals are requested, decided and audited in one place, in the console or over the API.

Risky tools: The SDKs and the MCP gateway pause before a sensitive tool runs and ask a person, once per run.
Recovery actions: Every action proposed on an incident is scored for risk on the server. Scoring fails closed: an unknown environment counts as production.
Four‑eyes on Business: On Business and Enterprise, high‑risk actions wait for a second person’s approval, and nobody approves their own request.
Approval ids at the gateway: A sensitive model answers only with an approved X-AIW-Approval-Id, valid for that model, key, environment and run.

End‑user plans, enforced per call.

Selling AI features on free and paid tiers? Send each end user and their plan with two headers, and an end‑user quota policy limits requests, tokens, cost and models for every user.

Limits per day or per month, by your own plan names.
Monitor first, then enforce.
Usage per end user and per plan in the console.

B2C apps

End‑user headers

import osfrom openai import OpenAI client = OpenAI(    base_url="https://gateway.worksi.ai/v1",    api_key=os.environ["AIW_API_KEY"],) def answer(    user_id_hash: str,    user_plan: str,    messages: list[dict],) -> str | None:    headers = {        # a pseudonymous id, not an email        "X-AIW-End-User": user_id_hash,        # your own plan name, e.g. "free"        "X-AIW-End-User-Plan": user_plan,    }    res = client.chat.completions.create(        model="gpt-5-mini",        messages=messages,        extra_headers=headers,    )    return res.choices[0].message.content

import OpenAI from "openai" const client = new OpenAI({  baseURL: "https://gateway.worksi.ai/v1",  apiKey: process.env.AIW_API_KEY,}) export async function answer(  userIdHash,  userPlan,  messages,) {  const headers = {    // a pseudonymous id, not an email    "X-AIW-End-User": userIdHash,    // your own plan name, e.g. "free"    "X-AIW-End-User-Plan": userPlan,  }  const res = await client.chat    .completions.create(      { model: "gpt-5-mini", messages },      { headers },    )  return res.choices[0]?.message.content}

Govern the tools your agents reach over MCP.

Register any MCP server and point agents at it through Worksi. The MCP gateway applies your tool policies to every session.

MCP

Filtered tool lists: An agent’s tools/list returns only the tools your policies and its allowed tools permit.
Approvals: A tool that needs a person returns -32002 approval_required with a pending approval to retry with once it is approved.
Refusals: A disallowed tool returns -32001 tool_not_allowed in enforce mode. An upstream timeout returns -32003.
Every call traced: Each tool call is a tool_call span, and the tool appears in your AI inventory.

Six roles, least privilege by default.

Every API endpoint checks the role of the person or token that calls it. Personal access tokens carry the user’s current role, so a changed role applies at once.

Owner: Everything, including granting ownership. The last owner can’t be removed.
Admin: Organization settings, members, providers, API keys, policies, ROI inputs and the audit log.
Operator: Incidents, recovery actions, approvals, alert channels and runbooks.
Developer: API keys, the AI inventory, incidents and runbooks.
Viewer: Read-only access to dashboards, traces, incidents and reports.
Auditor: Read-only access plus the audit log and its exports.

A record nobody can rewrite.

Every change to policies, keys, members, agents, incidents or approvals is recorded with who, what, before and after, in the same transaction as the change.

Hash‑chained: Each entry links to the previous one, and the database rejects edits and deletes.
Verifiable: A check recomputes the chain and reports the first broken entry.
Exportable: Export the audit log as CSV or JSON on Business and Enterprise.
Everywhere: The console, the API, SDK approvals and MCP operator tools write to the same log.

Explore security

Start with one policy in monitor mode.

Create a model allowlist in monitor mode, send traffic, and see what it would have blocked before you enforce it.

Start free trial Read the policies docs

Terminal

# AIW_TOKEN: a personal access tokencurl -X POST https://worksi.ai/api/v1/policies \  -H "Authorization: Bearer $AIW_TOKEN" \  -H "Content-Type: application/json" \  -d '{"name": "Production model allowlist",       "type": "model_allowlist",       "scope_type": "environment",       "scope_id": "production",       "rules": {"models": ["gpt-5-mini"]},       "enforcement": "monitor"}'