Solutions / Governance & Platform

The guardrails your platform needs, without starting from scratch

Your platform team builds the guardrails once. Developers and AI assistants work inside them without asking, and every request gets checked before the resource exists. It all runs where you decide.

Platform & DevOps

Stop being the ticket queue. Four-layer authorisation, SSO, an audit trail, and a runner you control or the CI you already have.

Developers

The guardrails are inside the golden path, so you don’t read the policy to comply with it.

Executives

Self-hosted, air-gapped or sovereign cloud, European by design. Nothing here is taken on faith.

Why

Access, audit and where it runs, settled before the resource exists

Your platform team shouldn’t hand-build every environment and then police it afterwards. Set the rules once and they hold for every request, from a person or an assistant. Developers stop waiting on you. The organisation gets delivery that’s compliant on arrival, not checked after the fact.

Without it

Audit as archaeology

Policy is a document, enforcement is a review, and the finding arrives a quarter after the resource did. Rights are copied from whoever left last.

Signs it’s your problem

A compliance finding names a resource nobody approved
Access rights are inherited from the last person who had the job
An AI assistant has the same rights as its user, everywhere, unobserved

With Cycloid

Ask first, every time

Forms validates every submission. Approval gates run before a deployment. Every Action, from a person or an assistant, passes the same four-layer authorisation chain and lands in the audit trail.

What changes

A non-compliant resource is refused before it exists
An assistant can be scoped tighter than its user, read-only or no destroy
One record answers the auditor, and everyone else

The trade-off · speed vs compliance · guardrails before the resource keep both

How

Four steps to guardrails everyone can work inside

Four steps, each with a page of its own. Where it runs first, then who may do what, then the environments, then the record of it.

Platform team

Pick where it runs, then shape the portal

Self-hosted, air-gapped or on a sovereign cloud. Then set the sidebar, resource pages and branding to fit how your teams work.

Platform team

Model the org, then decide who may do what

Teams, roles and Resource Groups, signed in through your IdP. ReBAC, RBAC, ABAC and approval decide who, or which assistant, may run what. All four must say yes.

Platform Team

Fix the environments and the names

Predefined environment types feed every Form, Blueprint and promotion. Naming rules check each new name at creation, so you still know what it is in a year.

Everyone

Run it, then read the record

The Native Runner runs Actions inside your environment, or hand them to the CI you already have. Every request, approval and Action lands in one audit trail.

What

Eight features that make the guardrails

Each has a page of its own. Here’s what it does, how, and who it’s for.

In this pillar

Self-hosted, air-gapped, sovereign

Deploys where your data has to stay, on a hyperscaler, a private cloud or fully disconnected, with licence validation that works offline.

Self-hosted first, European by design, ISO 27001 certified, open formats. TerraCognita and InfraMap are open source.

Built for

Executives

Platform & DevOps

Customisable portal

Shapes the sidebar, resource pages, dashboards and branding for a tenant, a team or one person.

Platform engineers set resource tabs per Blueprint, admins set the sidebar and brand colours, team leads their own sections.

Built for

Platform & DevOps

Developers

Org modelling & SSO

Maps teams, roles and Resource Groups onto your org, with isolated tenants for MSPs.

SSO through Entra ID, Okta, Keycloak or any OIDC or SAML 2.0 IdP, with SCIM.

Built for

Platform & DevOps

Executives

Four-layer authorisation

Runs every decision through four layers, ReBAC, RBAC, ABAC and approval. All four must say yes.

Built on OpenFGA. An assistant can be held tighter than its user at the tool layer.

Built for

Platform & DevOps

Executives

Plugins

Adds providers, data sources and widgets, official or your own, switched on per tenant.

Written in TypeScript and run in isolation. Install from the marketplace, a private registry or a tarball for air-gapped sites.

Built for

Platform & DevOps

Developers

Native runner, or your CI

Executes Actions where you decide: the Native Runner inside your environment, or your existing CI.

The Native Runner runs across clouds and on-prem, or hand execution to GitHub Actions, GitLab CI, Jenkins or Azure DevOps.

Built for

Platform & DevOps

Developers

Environment types & naming rules

Predefines the environment types every Form, Blueprint and promotion picks from, and checks every new name at creation.

Each type carries a default policy, such as approval on production. Naming rules apply per kind, per Blueprint or tenant-wide, and the closest rule wins.

Built for

Executives

Platform & DevOps

Audit log

Records every request, approval, Action and its outcome, with who or which assistant triggered it and under which authorisation.

Written by the platform as the Action runs, not a log sent from elsewhere. One request ID traces a change end to end.

Built for

Executives

Platform & DevOps

The whole picture of the Governance & Platform pillar