AI governance

AI governance is often discussed as policy — committees, principles, review boards. In a software product it is more useful to define it as mechanism: the specific code paths that filter what goes into a model, bound what comes out, cap what it costs, gate what it can change, and record what happened. A governance claim you cannot verify as a mechanism is a policy document, not a control.

Why it matters

Businesses adopting AI face two failure modes: an AI that does something harmful (leaks data, acts on a hostile instruction, writes to the wrong record) and an AI that does something expensive (unbounded token spend, surprise overage bills). Governance is the answer to both, and the test of any vendor’s governance story is whether the limits are published as numbers and enforced in code.

How governance works in Oneop

Oneop’s governance stack has four layers, each verifiable:

Guardrails with no off switch. Prompt-injection blocking and PII redaction run on every model call, in every workspace, on every plan — including the free one. No setting, plan or administrator disables them. An optional layer above — tool allowlisting, action-value ceilings, confidence thresholds — is a deployment-level setting rather than a plan feature, and stays off until it is switched on for your workspace.

One metered path. Every AI call in the product passes through a single routing function that charges the workspace’s credit balance before calling the model. Where hard cap enforcement is switched on for the deployment, the call at the cap is refused with an HTTP 402 rather than billed as an overage — there is no silent top-up either way.

Governed action with published ceilings. Agent runs are bounded by hard limits — iterations, tokens, wall clock, actions — and every proposed write passes through the autonomy-level engine before anything changes. Money and stock actions stay behind a separate switch that is off unless it has been turned on for your workspace.

An honest record. Every run stores its full reasoning trace and exit reason, and is badged Live or Simulated. A simulated run makes no model call and writes zero credit usage, so demonstrations cannot be laundered into an audit trail.

One provider underlies all of it: Google Gemini, with no multi-model routing.

Related terms: autonomy levels, human-in-the-loop. Product page: AI governance.