Decision input
Evaluate a request
Every field is a fixed choice. There is nowhere to paste a prompt, a customer record or a user identifier, so none can reach the rule engine or the proof.
Private browser tool
AI model usage policy gate
Before a prompt reaches a model, one question decides everything else: is this request allowed? Set the request context, the requesting role, the model id and the policy scope. The gate returns allow or deny, names the rule that failed, gives the remediation path, and signs the decision so it can travel with the call.
- Decision point
- Before inference
- Verdict
- Allow or deny
- Free-text fields
- None
- Decision history kept
- None
What the gate checks
Five rules run in order. Any single failure produces a deny, because a policy gate that averages its checks is not a gate.
Model policy registry
The model id must exist in the registry and be cleared for the stage it is in. A developer preview build is confined to engineering evaluation, general internal scope and internal-only output until it is promoted to general availability.
Role and entitlement graph
Each role holds a set of model tiers. A contractor reaches the small self-hosted tier, a support agent reaches the fast hosted tier, and a service account never touches third-party inference. Capability is granted, not assumed.
Data class and hosting
Confidential and special category input cannot leave the estate. If the registry says a model runs on third-party infrastructure, that combination is denied and the remediation points at a self-hosted route or redaction first.
Safety and abuse rule set
Purpose and destination together decide which controls are mandatory. Automated decisions about a person, customer-facing replies, published output, batch runs and code heading straight into a downstream system each pull in a specific control.
Policy scope obligations
Scope adds obligations on top. Health data requires self-hosted inference and review. Children's services blocks published output outright. Public sector delivery requires the decision to be logged in your own audit trail.
Running the same gate as a service
The rules on this page are deliberately portable. Each component below is open source, available today, and needs no vendor key to stand up.
Entry point
FastAPI
Holds the pre-inference endpoint. The request body carries the four policy attributes and returns allow or deny in a single round trip, so the gate sits inside the caller's latency budget.
FastAPI documentationRule engine
Open Policy Agent
Carries the registry, safety and scope rules as Rego. Policy lives in version control and ships through the same review as application code, which is what makes a rule version worth signing.
OPA documentationEntitlements
OpenFGA
Answers the role question. Relationship tuples map people, teams and service accounts to model tiers, so an entitlement change takes effect without a policy redeploy.
OpenFGA documentationEphemeral state
Redis
Holds rate and burst counters with a short time to live. It is deliberately not a decision store: nothing survives its expiry, so there is no history to subpoena or leak.
Redis documentationTracing
OpenTelemetry
Emits a span per decision carrying the rule version, verdict and failing rule id as attributes. Attribute names stay on the allow list so no request content reaches a collector.
OpenTelemetry documentationSignals
Prometheus
Counts allows, denies and each failing rule. A deny rate that climbs after a policy change is the clearest signal that a rule is wrong or an entitlement is missing.
Prometheus documentationWhat the gate never sees
A governance tool that asks you to paste the prompt has already become the risk it was meant to manage. This one takes only enumerated attributes: a model id, a role, a scope and four context values. There is no text input anywhere on the page, which makes the claim checkable rather than promised.
Nothing is transmitted. The rule set runs in the tab, the verdict is rendered in the tab, and the proof is signed with a key generated in the tab and discarded when it closes. No decision is written to a database here, and the reference architecture is built the same way, with Redis holding only short-lived counters.
Your own audit trail is a different matter and should exist. The proof artefact is designed for exactly that: attach the identifier to the inference call, keep the JSON in your system of record, and the verdict stays verifiable long after the tab is gone.
Standards and references
The rule shapes on this page follow published governance and application security guidance. Read the primary sources before adapting them to your own registry.
Application security
OWASP Top 10 for LLM Applications
The canonical list of failure modes for model-backed systems, including excessive agency and sensitive information disclosure.
Read the OWASP listRisk framework
NIST AI Risk Management Framework
Structures the govern, map, measure and manage functions that a pre-inference gate sits inside.
Open the NIST frameworkUK data protection
ICO guidance on AI and data protection
Covers lawful basis, meaningful human review and solely automated decisions with legal or similarly significant effect.
Read the ICO guidancePolicy as code
Open Policy Agent and OpenFGA
Reference implementations for decoupled policy decisions and relationship-based entitlements.
Rule set: ai-usage-policy-2026.08. The registry on this page is a worked example. Replace the tiers, hosting facts and lifecycle stages with the entries and contract terms that apply to your own estate.
Direct answers
Short answers for people, search engines and retrieval systems.
Does this AI request satisfy policy, safety and entitlement checks? It does when the model is registered and generally available, the requesting role holds an entitlement for that model tier, the input data class is allowed to reach the model's hosting arrangement, every control the purpose and destination require is genuinely in place, and the governing policy scope adds no unmet obligation. A failure in any one of the five produces a deny before inference.
Where should the gate sit?
In front of the model call, not after it. Once confidential input reaches a third-party endpoint the disclosure has happened, and no output filter reverses it.
Why binary rather than a risk score?
A score defers the decision to whoever reads it. A gate that returns allow or deny, plus the rule id that failed, is auditable and can be enforced by a client library.
What blocks a developer preview model?
Lifecycle. Preview builds pass only for an engineer or platform admin, under general internal scope, with internal-only output. Anything wider needs promotion in the registry.
What does a deny return?
The failing rule, the reason in plain terms, and a remediation path: request the entitlement, switch to a self-hosted model, turn on the missing control, or change the destination.
Questions
What is an AI model usage policy gate?
A check that runs before a prompt reaches a model. It compares the request against a model policy registry, a role and entitlement graph, safety rules and the governing policy scope, then returns allow or deny. A deny stops the call rather than filtering the answer afterwards.
Does the gate see the prompt text?
No. Every input is a fixed enumeration chosen from a menu. There is no free-text field on the page, so prompt content, user identifiers and customer data cannot be entered. The decision is made from policy attributes alone.
Why deny before inference instead of filtering the output?
Once confidential input has been sent to a third-party endpoint, the disclosure has already happened and an output filter cannot undo it. Pre-inference is the only point where a residency or entitlement failure can still be prevented rather than recorded.
What does the proof artefact prove?
That a browser key signed a specific rule version, attribute set and verdict at a point in time. The JSON carries the canonical payload, a SHA-256 digest, an ECDSA P-256 signature and the public JWK, so any P-256 implementation can verify it offline. It is not a legal opinion or a vendor assurance.
Can the same rules run as a service?
Yes. The decision shape maps onto FastAPI for the endpoint, Open Policy Agent for the rules, OpenFGA for the entitlement graph, Redis for short-lived rate state, and OpenTelemetry with Prometheus for traces and counters. None of those components needs to persist a decision history.
Can I use my own model registry?
Yes, and you should. The seven entries here are a worked example covering open-weight self-hosted builds, a developer preview and two hosted tiers. Replace the tiers, hosting facts and lifecycle stages with your own entries and contract terms.