the Immune System.
The defense. It rejects bad writes, gates the risky ones for a human, and keeps the flight recorder.
no real controls
68%
lacked AI governance
68% of breached organizations lacked AI governance to manage AI or detect shadow AI, and among those breached through AI, 92% lacked proper AI access controls.
Most companies bolt AI on with no real controls, and it gets expensive.
Give a model access to your systems and "be careful" is not a safeguard. When something goes wrong there is no gate that stopped it and no record of what happened.
Security incidents involving shadow AI more than doubled to 43% this year from 20% last year, and the average cost of those incidents rose to $5.39M from $4.63M. Only 29% of the governed run regular audits for unsanctioned AI.
where today falls short
A guardrail written into a prompt is a suggestion, not a wall.
You can tell a model the rules, but nothing forces it to follow them. A prompt-level guardrail lives in the same soft layer as the mistake it is meant to prevent, so a confused or jailbroken model walks straight through it. Real governance cannot live in the instructions. It has to live in the engine.
The organism's defense
Surround what does not belong.
A phagocyte
An immune cell that recognizes anything that is not the organism's own, engulfs it, and breaks it down before it can spread. does one thing well. It recognizes a cell that is not the organism's own, wraps it, and breaks it down before it can spread. The Immune System treats every write the same way. A request that fails a rule never lands; the database refuses it at the boundary, before it becomes a fact anyone has to trust. The diagram below shows the same rule two ways, one the model can walk through and one it cannot.
the answer
The model proposes. The database disposes.
Every action a cell takes is risk-classified, then committed with guardrails or held for a human. A bad write is not politely declined; it is refused in transit by the storage engine, mechanically, and it cannot be talked around. The AI itself is fenced by the same schema as everyone else, and every action lands in an audit logA permanent, add-only record of every action, which can be read but never edited or deleted, so the history always holds. that only grows.
more than a rule
What the record has that a prompt guardrail doesn't.
A rule you can ignore is not a safeguard. These are enforced by the engine, so they hold even when the model is wrong.
Bad data is refused in transit.
!Today A lone agent's bad value gets written first and cleaned up later, if anyone notices.
the cell A malformed value hits a validity check or an enumA field that only accepts a value from a fixed list, so a status can never be a typo or a value the system does not recognize. and the write is rejected by the storage engine before it lands. The record cannot hold an invalid state.
One tenant's data is invisible to another.
!Today A lone agent leans on application code to remember not to show the wrong person the wrong data.
the cell Row-level securityA rule the database engine enforces itself on every read and write. It filters which rows each person can see and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. filters rows inside the engine, keyed to who is asking. Another tenantA separate, walled-off customer account whose data no other tenant can see.’s row is not forbidden, it simply does not exist for you.
A human approves the risky ones.
!Today A lone agent acts first and hopes someone reviews the log afterward.
the cell Risky actions, like a schema or a grant change, are held at an approval gate until a human says yes. The work waits; it does not proceed on its own.
Every action lands in the flight recorder.
!Today A lone agent's actions vanish into a chat log nobody can query.
the cell Every action is written to an append-only audit logA permanent, add-only record of every action, which can be read but never edited or deleted, so the history always holds., permanent and queryable, so you can always prove exactly what happened and when.
from our own systems
The defense, enforcing today
These are not policies in a document. They are constraints in the running database, covering values that cannot be malformed, rows one tenantA separate, walled-off customer account whose data no other tenant can see. cannot see, changes a human must approve, and an audit logA permanent, add-only record of every action, which can be read but never edited or deleted, so the history always holds. that only ever grows.
KeyA green value is real, from our own database, as of Oct 8, 2026; in the diagrams, green marks a committed write.
every action, on the record
436,330A real count from our own database, shown as proof rather than a claim. It is a dated snapshot, captured Oct 8, 2026.
immutable audit rows
one immutable row for every governed action ever taken
a real count from our own database, as of Oct 8, 2026
gates cleared
8,966
approvals processed
enforced on every write
906
validity checks
who may see which row
179
row-level security policies
zoom in
Down to a single rejected write
One action, proposed by a cell, checked against the typed contract, and refused with a specific Postgres error before it ever touched the record. That is the immune response. Not a warning, a refusal.
- risk, approval, mergeeach action is risk-classified, and a risky one waits for a human’s yes before it goes ahead
- RLSShort for row-level security. It is a rule the database engine enforces on every read and write, filtering which rows each person can see and refusing writes they are not allowed to make. · CHECK · enumsA field that only accepts a value from a fixed list, so a status can never be a typo or a value the system does not recognize. · ZodA shape-check in the application code that validates data before it reaches the database, so bad input is caught early with a clear message.checks in the code and in the database that every write must pass, approved or not; a bad one is refused here
- the flight recorderThe permanent, append-only log of every action the organism takes, like a black box you can actually read, so you can always prove exactly what happened and when.every action is written to a log that only grows, so what happened can always be proved
Curious how a layer like this would fit your own records?