AutoPIL is an AI agent governance platform designed for regulated industries, ensuring that autonomous AI agents access data in compliance with organizational policies. By enforcing access controls at the point of data retrieval, AutoPIL prevents unauthorized sensitive information from entering an agent's context window. Each access decision generates a tamper-evident audit record, providing transparency and accountability.
Key Features and Functionality:
- Policy Engine: Utilizes YAML-based policies with allowlists, denylists, and sensitivity ceilings. Policies can be hot-reloaded without service restarts and managed via a REST API with version history.
- Immutable Audit Log: Logs every retrieval attempt, including decisions, matched policies, reasons, context hashes, and timestamps. The append-only log is cryptographically chained to ensure integrity.
- Tamper-Evident Hash Chain: Each audit event is SHA-256 linked to the previous one, allowing verification of the entire log's integrity with a single API call.
- Real-Time Alerting: Implements threshold rules for denial spikes, new data source access, cross-agent isolation violations, and high deny rates, with notifications delivered via webhooks or email.
- OpenTelemetry Integration: Emits spans and metrics from every policy evaluation, compatible with tools like Datadog, Grafana, and Splunk.
- Multi-Tenancy: Ensures row-level tenant isolation across all tables, with separate audit events, policies, and alert rules for each tenant.
- Cross-Agent Isolation: Automatically denies and logs attempts by agents to access sessions initiated by other agents, ensuring strict session boundaries.
- Async-Native Support: Provides concurrent-safe tracking across asynchronous agents, compatible with asyncio, FastAPI, and aioboto3.
- ASGI Middleware: Offers HTTP-layer enforcement for FastAPI and Starlette applications, with route-based policy mapping and shadow mode for non-disruptive rollout.
- Live Dashboard: Features real-time charts, full-text search, isolation violation banners, trend indicators on denial rates, and distribution analysis across integration channels.
- PIL Score: Computes a governance health index from recent enforcement activity, highlighting strengths and areas for improvement.
Primary Value and Problem Solved:
AutoPIL addresses the critical need for governance in autonomous AI systems, particularly in regulated sectors where data access violations can lead to significant compliance incidents. By enforcing access policies at the data retrieval layer, it ensures that only authorized data enters an agent's context, mitigating risks of unauthorized access and data breaches. The platform's comprehensive audit trails and real-time alerting mechanisms provide organizations with the tools to monitor, verify, and maintain compliance, thereby fostering trust in AI-driven processes.
