We build the full AI implementationAgents, workflows, and governed data access
We build the agentic solution to your named problem, and every agent reaches production data through Ekaya — the governed AI data gateway — the open-source enforcement and evidence layer that gets the implementation through security review, even where live LLM access is not allowed.
Code-first? Ekaya Runtime — Apache-2.0, request source access.
Inline — every request
Ekaya Runtime runs in your environment and checks who is requesting what data, and what permissions they have.
Inside Ekaya — Approved Queries
Production agents run from a reviewed query library, not a fresh SQL guess every time.
Every query an agent can run in production starts here: reviewed, approved, and tied to the exact SQL it executes. Pending and rejected queries are tracked the same way, so the approved set is always an accurate record of what agents are allowed to ask.
See the risks Ekaya controls
Why teams bring in Ekaya
The hard part starts when agents need production data.
Vibe-coding gets the prototype built; production access still has to satisfy security, residency, governance, and audit requirements. These four data-boundary risks are what Ekaya controls.
MIT's GenAI Divide report reports that most enterprise GenAI efforts deliver no measurable return when they are not integrated with real operations.
Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027 because of cost, weak value, or inadequate risk controls.
IBM's 2025 breach report found that nearly all organizations hit by an AI-related breach lacked proper AI access controls.
The agent has write access to production.
Replit's AI coding agent ran destructive commands against a live production database during an explicit code freeze, ignored instructions to stop, then misreported whether the data could be recovered.
Agents never hold raw credentials. Tools are scoped per Project, destructive and schema-changing operations are blocked by deterministic policy, and risky writes route to a human approval gate.
See howThe agent can reach more than it should.
EchoLeak (CVE-2025-32711, CVSS 9.3) used a single crafted email to turn Microsoft 365 Copilot against itself and exfiltrate internal data with zero clicks — and MCP tool poisoning has turned trusted tools into exfiltration paths across thousands of exposed servers.
Ekaya assumes the agent can be compromised. Each agent gets a scoped identity with least privilege — no aggregated credentials — and because agents reach data only through Ekaya, unsafe access is caught in the path, before data leaves.
See howThe answer is confidently wrong.
Naive text-to-SQL can silently return the wrong data: broken queries stay syntactically valid, so they run, return plausible results, and answer the wrong question. Schema hallucination — invented tables, columns, and joins — is a common production risk.
Agents work from a governed set of approved queries and an agent-shaped data model validated against the real schema at design time, instead of trusting one generated query. Every query path in production is defined and reviewable, so a wrong answer is caught before it becomes a decision.
See howYour data can't leave; their AI runtime can't come in.
Regulated and air-gapped organizations can't send records, prompts, schema metadata, or approvals to a third-party runtime. A pilot that depends on a live cloud model beside production data cannot ship.
Ekaya treats production data access as an air-gappable service. Ekaya Admin produces and reviews the artifact set; the open-source Ekaya Runtime then enforces policy and serves approved queries entirely from those frozen artifacts, inside your boundary.
See howInline enforcement
Control in the path, not alerts after the fact.
Enforcement sits in the access path itself. Agents reach production data only by going through Ekaya, so every query is evaluated against deterministic policy before it executes — block, mask, limit, require approval, alert, or remediate.
out-of-band monitoring
governed data access interface
In the path
Ekaya is the governed data access interface agents call into. There is no side door to production data, so there is nothing to catch up to after the fact.
Before the query runs
Block, mask, limit, or require approval happens inline, at the point of access — not in a report you read tomorrow.
The model assists; it never enforces
Detection can be smart, but the decision to allow, block, or mask is deterministic policy. A model can be wrong and the data is still safe.
Inside Ekaya — Schema Scoping
Agents see the tables and columns you select — nothing else.
Each Project's data model starts from an explicit schema selection. Tables and columns you leave out don't exist as far as the agent is concerned, so least privilege is the starting point — not a policy you retrofit after the first incident.
Every tool call, approval, query, model-facing decision, and write-back path is captured as a reconstructable timeline. Security and compliance teams can replay exactly who and what touched which data — an audit or incident review is evidence you already have.
Inside Ekaya — Ontology Extraction
Ekaya learns what your data means, so agents don't guess.
During the build, Ekaya Admin reads the real schema and extracts the business meaning behind it — entities, relationships, and the domain model your agents answer from. Humans review and approve what it infers, so the agent-shaped data model is governed knowledge, not a hallucinated guess.
See how Ekaya Runtime uses it
Ekaya Runtime
Build with AI. Run production access without it.
Ekaya separates implementation from production operation. Ekaya Admin can use models to understand the data estate and shape the controls; the open-source Ekaya Runtime serves the approved production path from frozen artifacts.
Use AI before production
Connect datasources, extract ontology, classify sensitive data, draft policies, configure applications, and prepare approved query paths in Ekaya Admin during implementation and maintenance windows.
Freeze the operational artifacts
Review and promote the operational artifact set — datasource configuration, ontology, classifications, policies, and approved queries — into a frozen, versioned bundle.
Enforce from the frozen set
Production data access runs from the frozen set. Ekaya Runtime blocks, masks, limits, requires approval, and records audit events without live inference or runtime mutation.
Removed from production runtime
- No live LLM capability
- No outbound model calls
- No runtime metadata mutation
- No runtime query-path approval
Inside Ekaya — Model Configuration
Choose where inference runs — including inside your boundary.
Bring your own OpenAI-compatible keys, pick a community model, or run embedded AI so inference never leaves your environment. AI allows you to extract the ontology and create approved queries during development. When you are ready for production, the open-source Ekaya Runtime serves data access with no live model access at all.
On-Prem & Custom Solutions
If your AI implementation is ready for real data, Ekaya should be in the design review.
Custom Solutions is forward-deployed engineering: bring a named problem, a workflow, or customer demand, and we build the full solution — the agents and the governed data path that get it through production readiness — inside your boundary.
Every delivery lands on the open-source (Apache-2.0) Ekaya Runtime. We deploy it in your environment — or your client's — and stand up the governed data access layer with you.
What an implementation includes
- We design and build the agentic solution — the agents, workflows, and approval gates that solve your named problem.
- We deploy the open-source Ekaya Runtime in your environment — or your client's — as the governed data path every agent goes through.
- Security-review evidence: approval queues, query logs, policy decisions, and per-project audit trails.
- An air-gappable production path for environments that cannot allow live LLM access — no live inference, no runtime mutation.