Risk dashboard
Weighted risk score 0-100 per agent and per organization. Severity breakdown, trend charts, and critical findings without hunting.
Observe. Control. Govern.
Three layers. Three board-level questions. Every AI system in your organisation, from the same console.
Gateway Architecture
The agent can only talk through the boundary.
Identity, policy, spend, data controls, and signed evidence sit outside the agent runtime.
Agent side
EmployeesCustomersPartnersLangGraphOpenClawCustom agents
HikmaAI Intelligent Gateway
Identity + tenant
Prompt threat signatures
Credential injection
Tool allow-list
Session correlator
URL exfil scanner
Trust decay
Budget limits
Egress lockdown
Upstream side
LLMsMCP serversInternal APIsSaaS APIs
What The Engineering Team Gets On Day One
One binary. One YAML. Everything you need from the first deploy.
01
One audit log for every token, tool call, and secret use
Incident response has one place to look - across all agents, tools, and tenants.
02
Provable secret containment
Secrets exist in exactly one container. Never in agent memory, logs, or stack traces.
03
Cost ceiling guaranteed by infrastructure
The gateway returns 429 after spend limits are reached - before the budget burns.
04
OWASP LLM Top-10 coverage from day one
LLM01 prompt injection, LLM06 PII disclosure, LLM08 excessive agency, LLM10 unbounded spend.
05
Policy surface that survives the next framework
LangGraph today, OpenClaw now, whatever ships next. Your security posture outlives the choice.
06
Audit-ready by default
EU AI Act, SOC 2, and ISO 42001 conversations get shorter when every action is already logged.
Observe
Prove posture, not promise it.
Continuous coverage with audit-grade evidence.
“What is running in my environment and what is it doing?”
Signed audit logs
Every action logged with actor, timestamp, source IP, and change performed. Ed25519-signed CSV exports for record-keeping.
Real-time notifications
Assessment progress, critical findings, and compliance drift surfaced in-platform and via webhook.
PDF compliance reports
Board-ready and regulator-ready exports for every assessment, with signed audit logs attached as evidence.
Control
Know your risk before incidents do.
Automated red-teaming, compliance, and code-level audit.
“Am I blocking threats in real time?”
Adaptive red-teaming
Active attacks tailored to your agent's actual behavior, not a static checklist of generic prompts.
OWASP Top 10 for LLM
Coverage across prompt injection, jailbreaking, data leakage, insecure output, excessive agency, and supply chain.
EU AI Act Articles 6-52
Article-by-article evaluation including Article 15 enhanced pillars: accuracy, robustness, and explainability.
MCP and source-code coverage
Tool enumeration, permission analysis, and input validation for MCP servers, Git URLs, and ZIP uploads.
Govern
Enforce what policy requires.
RBAC, tenant isolation, programmatic control.
“Can I prove my agents behave as intended?”
Role-based access
Admin, Member, and read-only roles separate security, platform, and compliance duties. Every privileged action is logged.
Private Agent Connector
Scoped API keys for programmatic integration. Pin keys to specific agents; revoke without touching user auth.
EU AI Act metadata
Risk classification, lifecycle stage, and regulatory context attached to every agent and reflected in every report.
Cryptographic audit exports
Ed25519-signed bundles for regulators and auditors. Tamper-evident and verifiable without the platform.
The Intelligent Gateway
Twenty controls. Eleven languages. One auditable binary.
The gateway is the only thing the agent can talk to. Everything else is declared, allow-listed, and audited.
Zero Production Change
No SDK. No code changes. Under 30 minutes.
One engineer. Works with every framework you already operate.
Self-hosted
Installs on your hardware or private cloud. Your data never leaves your perimeter. Air-gapped. Zero telemetry.
SaaS
Cloud-hosted. Zero infrastructure to manage. Your deployment choice does not change the commercial value of HikmaAI.
Deploy In 5 Steps
Operational in under 30 minutes. One engineer.
Step 01
Drop in the container
One binary, one YAML. Runs as a Kubernetes sidecar or Deployment, standalone Docker container, or transparent proxy.
Step 02
Point your agents at the gateway
The agent calls the gateway instead of the provider directly. It holds no token and knows no upstream URL.
Step 03
Declare identity, capability, and budget
One YAML block per agent: providers, tool allow-list, cascade depth, budget tier, and attestation key.
Step 04
Turn on the controls
Baseline in alert mode, then promote controls to enforce in a shadow-then-flip motion.
Step 05
Operate
Stream JSON logs to your SIEM. Export OTel spans. Rotate secrets without restarting pods.
<30ms
Gateway latency
Per call
50+
Attack vectors
Tested continuously
<30 min
Deployment time
One engineer
No SDK.
No code changes
In your systems
Multilingual
& multimodal
By default
11
Native languages
ML classifiers
Aligned to
EU AI ActISO 42001SOC 2NIST AI RMFOWASP LLM Top 10GDPR
Request Demo
Stop hoping. Start proving.
Request a 30-minute demo. We walk your team through the threat model for your specific agentic footprint - and what controlling it looks like.