AI-Substrate

Access infrastructure for AI-built software

We’re solving the
forward deployed
engineer.

AI already writes the integration. What it can’t do is get safe access to the systems that matter — and that job doesn’t scale by hiring.

  • Judged once per shape
  • Enforced in microseconds
  • Credentials never leave your network

One request, three states

  1. It arrives

    POST /transfers
amount   4820.50
to       "acct_9f2"
memo     "Q3 payout"

    A request from an app someone built last Tuesday.

  2. We reduce it to its shape

    POST /transfers
amount   number
to       string
memo     string

    Field names, types and ranges. String contents stay in your network.

  3. The shape is judged once

    amount <= 10000
to.startsWith("acct_")
budget   400/min · 40k/day

    Every request after this one is a hash lookup and a compiled check.

Language — a model reads your brief, once per shape Machine — deterministic, every request, no model in the path

Everyone can build the tool.
Nobody can get the data.

The tools build themselves now

Anyone in your company can ship a working internal app this afternoon. None of them can be handed a production credential.

So access becomes a queue

Every request lands on the one team allowed to grant it. That team becomes the bottleneck, and then the bad guy.

And the queue gets routed around

Whoever can’t wait borrows a credential from someone who has one. Access you can’t see is access you can’t govern.

The forward deployed engineer was never paid to write the integration. They were paid to be trusted with the credential.

Fit

This is for you if

Two of these is usually enough. Tell us which ones →

  • The internal apps in your company already outnumber the engineers who understand them.
  • Access requests queue behind one team, and that team is your constraint.
  • You’d rather govern the traffic than ban the tools, because banning them hasn’t worked.
  • You can’t answer “what can this app actually reach?” without reading its code.
  • Your security review opens with where the data goes, and ends there.

Interception

Every call goes through one plane.

Apps get a gateway URL instead of a credential. The plane runs inside your network and holds the keys; we never see them.

How traffic is intercepted Apps on the left send requests to the AI-Substrate data plane, which runs inside your network alongside your sources and holds their credentials. A hosted control plane above sends rules down and receives request shapes up, never credentials or payloads. CONTROL PLANE — HOSTED BY US briefs · the judge · rule storage rules down shapes up — no values, no credentials, no payloads YOUR NETWORK YOUR APPS Invoice reconciler Ops dashboard Churn analysis no credentials DATA PLANE hash look up evaluate credentials 0 network calls YOUR SOURCES Salesforce Production Postgres Internal billing API
Apps hold no credentials. The plane holds them, and it sits inside your perimeter.

Inside the plane, there are two paths.

A shape is expensive exactly once. After that it costs a hash lookup and a compiled expression.

The hot path and the cold path A request is canonicalised into a shape and looked up in an in-memory snapshot. A known shape evaluates its predicate and budget and is forwarded in microseconds. An unknown shape escalates once to the judge, which reads the brief and writes a rule back into the snapshot. The judge reads your brief emits a predicate + a budget unknown shape — seconds, once, then never again Request Canonicalise spec-driven → shape Snapshot lookup signed, in memory Predicate + budget compiled CEL known shape — microseconds, every request, no model a failing predicate escalates — never a silent deny
When our control plane is unreachable, known shapes keep flowing and unknown ones are denied. Fail static, not fail open.

Technical background

How it holds up.

A paragraph of English is the policy
You pick a generated posture per source — read-only, narrow write — and refine it in plain text. Before it takes effect you see the actual allow, deny and cap verdicts it produces.
Shapes, not requests
Requests differing only in their values share one canonical shape, so the expensive judgement happens once per shape rather than once per call.
Predicates, not verdicts
The judge emits a constraint in restricted CEL, compiled when the snapshot is built. A malformed predicate is a build error, never a runtime failure.
Every rule carries a budget
The real failure of a self-built app is a retry loop, not an attack — every request in it is individually fine. Calls per minute, per day and rows per call are capped by default.
Your data never reaches a model
The judge sees field names, types, numeric ranges and enum values. String contents never leave your network, which closes the injection surface by construction.
Fail static, not fail open
Every node serves from a signed in-memory snapshot with zero network calls on the hot path. Lose the control plane and you lose new adjudications, not your traffic.
Denials are written for the coding agent
A denial carries a stable code and a shape reference. The agent that built the tool asks what would be permitted, reshapes the request and re-warms it. No ticket, no queue.
Shapes are judged before you ship
A coding agent submits the shapes it intends to send while it is still building, and gets adjudicated on the spot. Seconds are free at build time; they are not free in production.

Design partners

Tell us what’s blocked.

One source system, one brief, one afternoon. If it isn’t carrying real traffic by the end of the week, we’ve wasted your time and we’ll say so.

  1. 01We scan one repository and pull the source’s spec.
  2. 02You pick a posture and refine it in a sentence.
  3. 03An app warms its shapes and starts reading real data.