Least privilege
Deny-by-default capability check per agent and per tool. An ungranted or high-stakes tool never runs autonomously.
SolutionsEverything Geniaz
Everything Geniaz
builds.
Different domains, the same idea: be the layer the work runs through. More products are in development.
Enterprise AI
GenVeris
The Enterprise AI Control Plane
The layer an organisation’s AI runs through. Every model, agent and tool registered in one place, every call routed and authorised, and policy enforced in the request path.
Real estate & constructionGenie
One platform for every stage of the build
From land acquisition to project handover: documents, tenders, procurement, vendors, execution, inventory and analytics in one command centre — replacing the five systems and the spreadsheets between them.
A Geniaz solutionGenVeris
GenVeris
Enterprise AI Control Plane.
The layer your AI runs through. Every agent, tool and model call passes one deterministic pipeline — authorised, contained and recorded — so policy is enforced at call time rather than written down and hoped for.
Overview
One place everything runs through
A control plane decides; the systems below it carry the work out. Because every call passes through GenVeris, the same four things happen to all of them — which is why governance stops being a periodic exercise and starts being a property of how your AI runs.
In the request pathOne call. Six gates.
One call. Six gates.
One answer.
This is the part a policy document cannot do. Every request an agent or copilot makes arrives here before it reaches anything real, and leaves with a decision attached to it.
- Deny by default
- A tool call that has not been granted does not run. There is no implicit allow to fall back on, and no shadow path around the gateway.
- The first refusal ends it
- Gates run in order and the first one to say no stops the request. Nothing proceeds with a warning attached, and an override is itself an event.
- The decision is the record
- The audit entry is written in the path, as part of the decision — not reconstructed afterwards from whatever the applications happened to log.
agent
support-copilottool
crm.contact.readdestination
api.crm.internal- 01validate
- 02tenant
- 03model policy
- 04least privilege
- 05egress
- 06runtime
EVALUATINGrequest received
audit chainsha-256
waiting for first decision…
Capabilities
What GenVeris does
Nine capabilities. The first six are what makes it a control plane; the last three are what you get because it is one.
Egress policy
Allow-list plus named deny categories on the destination. Closes data exfiltration and SSRF against the metadata service.
Capability tokens
Short-lived, per-call, scoped. No agent holds a standing key, so revocation is instant rather than eventual.
MCP supply chain
Tool manifests are hashed and pinned at approval. A rug-pull, an unsigned publisher or an unpinned manifest blocks the bind.
Human in the loop
A granted but high-impact action routes to a named approver instead of executing. Set by type or by value.
Circuit breaker
Scores live risk signals and escalates through downscope, suspend and halt — revoking tokens inside their lifetime.
Content and memory DLP
Classify, mask or refuse at the boundary. Restricted content is never persisted, and recall re-checks class at read time.
Output and grounding
Toxicity and groundedness checks on the response, with deterministic claim-grounding escalated to a strict judge when uncertain.
Hash-chained audit
Every decision appended as a SHA-256 chained record. Alter one row and every hash after it breaks.
A more capable model is better at being
argued out of its instructions.
It is no better at forging a capability token, or at reaching a destination the egress policy denies. That is why the controls hold around the model rather than inside it — and why buying a better model is not a governance strategy.
Solutions
Business problems GenVeris solves
If one of these is a sentence someone has said in your organisation this quarter, this is the section that matters.
“Our AI policy exists, but nothing enforces it.”
Policy runs as deterministic gates in the request path — allow, mask, escalate or block, per call, with the decision written to the audit chain either way.
“Agents can reach tools and data nobody signed off on.”
Deny-by-default capability checks per agent and per tool, and a short-lived scoped token minted per call rather than a standing key.
“A tool server changed after we approved it.”
MCP manifests are hashed and pinned at approval. A widened scope, an unsigned publisher or an unpinned manifest blocks the bind outright.
“Sensitive data is reaching models we do not control.”
Content DLP classifies and masks at the boundary, egress policy denies the destination, and Restricted content is never written to memory.
“We cannot prove what our AI did last quarter.”
Every decision is a SHA-256 chained record. Re-verification detects a single altered row, and the surfaces flag it rather than quietly reading on.
“An agent went into a loop and nobody caught it.”
Runtime guard on loop, rate and concurrency, and a circuit breaker that escalates and revokes live tokens mid-session.
Industries
Where GenVeris is applied
The obligations differ by sector; the underlying need — one place your AI runs through — does not.
Financial services
Model calls that touch customer and market data, routed by residency and recorded per request — with the trail supervisors expect falling out of the same path.
Healthcare & life sciences
Patient data redacted at the boundary rather than in each application, and clinical-facing systems held to a routing and retention policy set once.
Public sector
Procurement-grade control over which providers are reachable, from where, by whom — with a recorded decision behind every automated output.
Technology & SaaS
A control plane that keeps up with weekly releases: version prompts and models like any deployable, roll out in stages, roll back in one step.
Insurance
Pricing and claims models behind per-request authorisation, with the inputs and outputs of every decision captured as it happens.
Retail & consumer
Personalisation and agent traffic at volume, with cost attributed per team and provider failover that does not need an application change.
AI & Intelligence / Integrations / Security
Two planes, one record
GenVeris governs at two layers. Veris Enforce decides what happens at call time; Veris Intelligence turns the estate into framework-mapped evidence. Both write to the same audit chain.
Veris Enforce
The runtime plane. It decides, at call time, what an agent actually does — deterministically, around the model rather than inside it. A more capable model is better at being argued out of its instructions; it is no better at forging a capability token.
- Least privilege and egress containment
- Capability tokens, revocable mid-session
- MCP manifest pinning
- Runtime guard: loop, rate, concurrency
Veris Intelligence
The advisory plane. A governance advisor grounded only in the organisation’s own evidence, which declares its source on every answer rather than asserting from a model’s memory.
- Risk register, scoring and KRIs
- Control coverage and framework crosswalk
- Impact assessment and prohibited-use checks
- Lineage, provenance and drift
Integrations & security
Agents reach external tools only through registered MCP servers, and the model gateway is the only path to a model. Multi-tenant throughout, session-bound, with SSO against your directory.
- MCP servers: filesystem, GitHub, Postgres, Slack
- SSO via Google and Microsoft Entra
- Tenant-scoped by construction
- Full audit log, exportable to your SIEM
Case Studies
How the work tends to go
Recurring patterns from control plane rollouts. Named customer stories will replace these as they are approved for publication.
Consolidating nine stacks onto one gateway
Business units had each wired their own provider accounts and keys. Routing everything through one control plane put credentials in one place, made provider choice a configuration change, and produced a per-team view of spend for the first time.
Stopping patient data at the boundary
Redaction moved out of each application and into the request path, so every call was covered by the same rule. The record of what was blocked became the evidence the compliance team had previously assembled by hand.
Agents that can only reach what they should
An engineering organisation moved tool access behind per-request authorisation. Which agent may call which tool, on whose behalf, stopped being a code review question and became a policy the control plane enforces.
FAQ
Questions we are asked most
What is an Enterprise AI Control Plane?
The layer your AI runs through. Applications call it instead of calling a model provider directly, so one place decides what is allowed, routes the call, records what happened and holds the credentials. The control plane decides; your models and agents carry the work out.
Is this a GRC platform?
No. GRC tooling sits beside the stack and reports on it, periodically. GenVeris sits in the request path and runs it, per call. Assurance is something it produces because everything already goes through it — not the job it was built to do. Your GRC platform stays where it is and reads from GenVeris.
Do we have to route production traffic through GenVeris?
Through it is the point — that is what makes enforcement, routing and cost control possible rather than advisory. Most teams start in observe-only mode, where traffic passes through and nothing is blocked, then turn on enforcement per policy once they can see what would have been affected.
What does adopting it actually involve?
Applications call the GenVeris gateway instead of a model provider directly. Registering the agents and tools you already run, granting capabilities, and setting the first egress and DLP rules is the part that takes judgement, and it is paced by your teams rather than by us.
Is enforcement a model deciding what is allowed?
No, and that is the point. Every gate is a deterministic module — a capability check, a hash comparison, an allow-list match. A more capable model is better at being argued out of its instructions, but no better at forging a capability token or reaching a destination the egress policy denies.
Which models can run through it?
Only allow-listed ones. The permitted model ids are configuration, and a caller cannot request a model outside that list — the model policy gate refuses it before anything else happens. That allow-list is the control, and it is the same mechanism whoever the provider is.
Can GenVeris run inside our own environment?
Yes. Managed cloud, private tenancy and deployment within your own infrastructure are all supported, with the same feature set.
What does it cost?
Pricing is based on the volume running through the control plane and the deployment model, so it is quoted per organisation. Talk to sales and we will scope it against your actual estate.