LLM governance that blocks, not just logs.
Most AI governance products write violations to a dashboard. IronFrame stops the action at the tool boundary, before it executes — with a tamper-resistant audit trail your regulator can read.
pip install ironframe
Prompts don’t produce audit trails.
Most “AI reliability” products try to fix hallucination with more AI. IronFrame takes a different approach: deterministic enforcement outside the LLM context window. A model cannot rationalize around hooks it never sees.
| Capability | Prompt Engineering | RAG / Chain-of-Thought | IronFrame |
|---|---|---|---|
| Enforces tool boundaries at hook level | ✗ | ✗ | ✓ |
| Tamper-resistant audit trail | ✗ | ✗ | ✓ |
| Persists state across sessions | ✗ | Partial | ✓ |
| Compliance-ready out of the box | ✗ | ✗ | ✓ |
| Model-agnostic (any LLM) | ✓ | ✓ | ✓ |
| MRM / supervisory audit export | ✗ | ✗ | ✓ |
Above the model. Below your application.
IronFrame is a governance stratum. The enforcement logic executes outside the LLM context window. The model never sees the rules it can’t break.
Where IronFrame fits.
The word “governance” is overloaded in 2026. Most products in the category trace, log, and evaluate. A smaller set blocks at the LLM input/output boundary. Almost no one runs outside-LLM enforcement at the tool boundary. That last column is what IronFrame is.
Side by side.
| Capability | IronFrame | Arize | Credo | Portkey | ModelOp |
|---|---|---|---|---|---|
| Blocks at tool boundary | ✓ | ✗ | ✗ | ✗ | Partial |
| Hooks fire outside LLM context window | ✓ | ✗ | ✗ | ✗ | ✗ |
| Tamper-resistant audit log (append-only, HMAC, per-event SHA-256) | ✓ | ✗ | ✗ | ✗ | ✓ |
| SR 11-7 / EU AI Act Art. 12 documented mapping | ✓ | ✗ | ✓ | ✗ | ✓ |
| Per-event SHA-256 supervisory export | ✓ | ✗ | ✗ | ✗ | ✗ |
| Model-agnostic (Claude / GPT-4o / Gemini / open-weight) | ✓ | ✓ | ✓ | ✓ | ✓ |
Competitor capabilities are based on public documentation and marketing materials as of April 2026 (e.g., Arize Phoenix docs, Credo AI product pages, Portkey AI Gateway docs, and ModelOp governance controls).
None of the major named competitors (Arize, Guardrails, Fiddler, Credo, Monitaur, ModelOp) present an architecture where outside-LLM hooks sit at the tool boundary and enforce policy before agent actions execute, with hardened, append-only audit transport built in. Observability platforms focus on tracing and evaluation, gateway products intercept prompts and responses, and program-governance suites produce policies and evidence but do not sit inline with tool calls. ModelOp does advertise “inline protections” as part of its model-governance controls, but as a model-lifecycle platform with enforcement added into that context, rather than an enforcement-first agent middleware layer.
Everything LLM infrastructure needs.
- Hook Engine — deterministic pre/post hooks outside LLM context Open-core library
- Tool Risk Tier System (C21) — LOW / MED / HIGH classification Commercial runtime
- Capability Fence (C24) — exploit, recon, credential patterns blocked Commercial runtime
- State Machine · Agent Trust · I/O Schema Open-core library
- Immutable Audit Log — write-before-release, SHA-256 integrity Open-core library
- MRM Metadata (C22) — SR 11-7 & EU AI Act Art. 12 aligned Commercial runtime
- Supervisory Audit Export (C23) — tamper-resistant, CLI exportable Commercial runtime
- Conformance & Drift Engine · Context Budget Open-core library
- Model Abstraction Layer — fast / smart / cheap / verification routing Open-core library
- Budget Manager — per-request, per-session, per-day spend caps Open-core library
- Error Recovery Open-core library
- Self-Audit Engine — confidence scoring on every output Open-core library
- Logic Skills · Eval & Regression Open-core library
- KB Grounding Open-core library
Have a question? Ask the AI.
Ask about architecture, compliance mapping, or whether IronFrame solves your deployment challenge. Unbuilt capabilities go directly to the roadmap.
Production-grade LLM governance in minutes.
Open-source core, Apache 2.0. Install, wire up your API key, and every LLM call is audited, budget-capped, and enforcement-gated from line one.
Up in 3 lines.
# Install pip install ironframe from ironframe import IronFrameConfig from ironframe.mal.client_v1_0 import IronFrameClient config = IronFrameConfig.from_env() client = IronFrameClient(config) response = client.complete( prompt="Summarize key contract risks.", capability="smart", # fast|smart|cheap|verify ) print(response.content) print(f"Confidence: {response.confidence}") print(f"Cost: ${response.cost:.4f}") # Every call: audited, budget-capped, confidence-scored.
pip install "ironframe[openai]" # GPT-4o / Perplexity pip install "ironframe[z3]" # Symbolic verification pip install "ironframe[all]" # Everything
Open core. Commercial power.
- C19 Session Methodology Registry
- C20 Dependency Registry + Scanner
- C21 Tool Risk Tier System (core)
- Hook Engine · Self-Audit Engine
- Model Abstraction Layer · Budget Manager
- Base compliance classes (build your own adapters)
- C22 MRM Metadata + Decision Log
- C23 Supervisory Audit Export (SHA-256, CLI)
- C24 Offensive Capability Fence
- HIPAA, FINRA, SOC2, SEC, GDPR adapters
- C25 Bank Reference Architecture
- Multi-user management · Hosted tier (coming)
LLM governance for regulated industries.
IronFrame’s commercial tier is built for financial services, healthcare, and government — organizations that cannot deploy AI without a verifiable audit trail, risk management log, and explainable output chain.
Built for regulated environments.
IronFrame is purpose-built for organizations where an unaudited AI decision has legal, financial, or patient-safety consequences.
Which component satisfies which requirement.
The components below are part of IronFrame’s runtime/commercial surface. The open-core library at github.com/briancarter456546/ironframe provides the SDK foundation — model abstraction, hook engine, audit log primitives, conformance — while runtime/commercial deployments add MRM logging (C22), supervisory export (C23), capability fencing (C24), and per-tier tool risk enforcement (C21).
| Regulation | Requirement | IronFrame Component | Notes |
|---|---|---|---|
| EU AI Act Art. 9 | Risk management system | C21 Tool Risk C24 Capability Fence | Tool tier classification + offensive capability blocking |
| EU AI Act Art. 12 | Logging & traceability | C22 MRM Log C23 Audit Export | 6-month retention, SHA-256 integrity, supervisory export |
| EU AI Act Art. 14 | Human oversight | C21 HIGH gate C22 MRM Log | TOOL_APPROVAL_REQUIRED blocks until human approves |
| EU AI Act Art. 15 | Cybersecurity & robustness | C24 Capability Fence | Exploit/recon/credential patterns blocked by allowlist |
| SR 11-7 / BCBS 350 | Model risk management | C22 MRM Metadata C23 Audit Export | MRMSession + MRMDecision; JSON/YAML supervisory export |
| FINRA Rule 3110 | Supervision & records | C23 Supervisory Export | --supervisory flag strips internal metadata for regulators |
| HIPAA | PHI audit trail | Compliance Adapter Audit Log | HIPAA fields captured natively in audit schema |
| FedRAMP Moderate | Continuous monitoring | C23 Audit Export C24 Fence | LLM-agnostic — works on approved models, not Anthropic-locked |
Full runtime governance surface.
pip install ironframe ships the open-core library — C1–C18 + SAE, the SDK foundation. A custom IronFrame engagement deploys the full runtime governance surface below: 32 built components plus the hook layer that fires outside the LLM context window plus the audit transport hardened on dedicated infrastructure. Components are listed honestly: Live in our own production ops today, Wiring for components that are tested but whose runtime invocation is still being completed, Roadmap for components included for transparency.
- C19 Session Methodology InjectionUserPromptSubmit hook, 13 governance rules per session
- C20 Dependency Registry + Scanner
- C21 Tool Risk Tier Registry35 tools classified, LOW / MED / HIGH, PreToolUse enforcement
- C22 MRM Metadata + Decision LogAuto-starts on every session; SR 11-7 / EU AI Act Art. 12 aligned
- C23 Supervisory Audit ExportThree-branch resolver, no silent fallback, FileNotFoundError on missing source
- C24 Offensive Capability FenceOffensive-code, recon, credential patterns blocked in NORMAL_DEV
- C25 Bank Reference ArchitectureEU AI Act / SR 11-7 / BCBS 350 doc mapping
- C26 Topology VisibilityManifest + verifier + cron
- C26.1b Governance Layers 4–6Admin gate + freeze flag (the armed emergency-stop)
- C26.2 Asset Registry
- C27 Append-Only Audit CollectorHMAC-signed O_APPEND, hardened systemd unit, deployed since 2026-04-18
- C30 Preflight Speed-Check HookAST + runtime-history Red/Yellow/Green scoring on Python invocations
- C31 Worker-Count Guard Hookpsutil PreToolUse cap on concurrent worker processes
- C32 DACI Domain-Aware Context InjectionDomain-keyed context loaded once per session at moment of entry
- SAE Self-Audit Engine Phase 1 CLI5 subcommands: judge / confidence / verify / tier / evaluate-session
- Designer Contract v1 + Lane disciplinePre-design 7-question checklist + lane-discipline-guard hook (informs delivery quality)
- C11 Security / Injection DefenseLibrary-only today; runtime hook wiring in queue
- C13 Eval & Regression Harness141 tests run on-demand; CI cron pending
- C17 Agent Trust + KillSwitchKillSwitch class exists; not armed today — the armed emergency-stop is C26.1b freeze flag
- C18 Spec Conformance + DriftCLI exists; cron pending
- HIPAA / FINRA / SOC2 / SEC / GDPR adapter loadersTested; runtime loading is the post-FINRA-first wiring work
- SAE Phase 2 samplerPostToolUse hook + in-MAL sampler — task #875
- C28 User Attribution + Human Approval GateNamed-human attribution layer for SR 11-7. The gate primitive itself works today via C21 HIGH tier.
- C29 Dashboard + Multi-User TokensSelf-serve commercial tier
- C36 MCP Governance ServerExternal-distribution wedge: deployable MCP server that wraps any MCP deployment with IronFrame governance
- C37 Hook Telemetry Feedback LoopSelf-improvement loop: aggregates audit events, flags hooks with high false-positive rates
- C38 Design Doc EnforcementSpec only, warn-only mode today; gates new high-impact changes on a 7-section design doc