Method · Governor
Every request goes through the Governor first.
Whether it comes from Harness, WorkBuddy, Claude, ChatGPT or an agent you built yourself, every read, write, relation change and action against the Ontoxiom Data Engine must first be authorised by the Governor. There is no bypass, and owners are no exception.
How a request is decided
Deny wins. Default deny. Approvals collected automatically.
The Governor evaluates every applicable policy together. There's no first-match-wins and no priority order to game.
Sales agent
List unshipped orders for East China customers
Governor
- 1. DenyAny matching deny blocks
- 2. ConstrainEvery constraint must pass
- 3. GrantAt least one grant is required
- 4. RequireCollect obligations such as approval
Data Engine
$ Audit log --follow
Why it's secure
Security isn't a feature. It's the architecture.
One way in
Agents never receive a database connection or system credential. All access enters through the semantic interface, and every interface passes the Governor first.
Default deny
No grant means no access. Conditions that can't be evaluated count as a deny; they never quietly become an allow.
Property-level permissions
Permissions apply to object types, individual properties, relations and actions. On the same customer, sales can see contacts but not the credit score.
Agents get no extra power
Every tool an agent uses maps to an endpoint a person can call, authorised the same way. API keys are bound to a specific role and business scope.
Check, then execute
Actions preview their effects and obtain a check token before executing; anything needing approval goes to the Decisions inbox. Execution applies completely or not at all.
Complete audit trail
Who, through which agent, when, what was requested, which policy allowed or denied it, and the result: every step is recorded, and past data states can be replayed.
Credential isolation
Business-system credentials are used only inside governed connectors and never appear in logs, previews or anything an agent can read.
Workspace isolation
All data is scoped by workspace. A non-member asking for another workspace gets “not found” rather than “forbidden”, so not even existence leaks.
Deployment & data
Your data stays in your environment.
Private deployment
Run the whole platform in your data centre, private cloud or dedicated cloud, including fully on an intranet.
Bring your own model
Use the model providers you choose, including open models you self-host. Your data never has to leave your environment.
Never used for training
Qihuan never uses customer data to train any model.
FAQ
Security questions
An agent never has more permission than the person it acts for. Every request passes the Governor first: deny wins, the default is deny, and permissions go down to individual properties.
Writes only happen through predefined actions: the effects are previewed and a check token is issued, anything needing approval goes to the Decisions inbox, and execution applies completely or not at all.
Turn your business into a world AI can understand.
Bring one concrete business problem. We'll tell you honestly whether it makes a good first use case.