the Immune System.
The defense. It rejects bad writes, gates the risky ones for a human, and keeps the flight recorder.
the challenge
63%
63% of organizations have no AI governance policy, and 97% of those breached through AI lacked proper AI access controls.
Most companies bolt AI on with no real controls, and it gets expensive.
Give a model access to your systems and "be careful" is not a safeguard. Most organizations running AI have no governance policy at all, and the ones breached through AI almost never had proper access controls. When something goes wrong there is no gate that stopped it and no record of what happened.
$670k
20% of breaches now involve shadow AI, adding $670,000 to the average breach; only 34% of the governed audit for unsanctioned AI.
IBM, Cost of a Data Breach Report, 2025where today falls short
A guardrail written into a prompt is a suggestion, not a wall.
You can tell a model the rules, but nothing forces it to follow them. A prompt-level guardrail lives in the same soft layer as the mistake it is meant to prevent, so a confused or jailbroken model walks straight through it. Real governance cannot live in the instructions. It has to live in the engine.
The organism's defense
Surround what does not belong.
A phagocyte
An immune cell that recognizes anything that is not the organism's own, engulfs it, and breaks it down before it can spread. does one thing well: it recognizes a cell that is not the organism's own, wraps it, and breaks it down before it can spread. The Immune System treats every write the same way. A request that fails a rule never lands; the database refuses it at the boundary, before it becomes a fact anyone has to trust. The diagram below shows the same rule two ways: one the model can walk through, and one it cannot.
the answer
The model proposes. The database disposes.
Every action a cell takes is risk-classified, then committed with guardrails or held for a human. A bad write is not politely declined; it is refused in transit by the storage engine, mechanically, and it cannot be talked around. The AI itself is fenced by the same schema as everyone else, and every action lands in an audit logA permanent, add-only record of every action, which can be read but never edited or deleted, so the history always holds. that only grows.
more than a rule
What the record has that a prompt guardrail doesn't.
A rule you can ignore is not a safeguard. These are enforced by the engine, so they hold even when the model is wrong.
Bad data is refused in transit.
!Today A lone agent's bad value gets written first and cleaned up later, if anyone notices.
the cell A malformed value hits a validity check or an enumA field that only accepts a value from a fixed list, so a status can never be a typo or a value the system does not recognize. and the write is rejected by the storage engine before it lands. The record cannot hold an invalid state.
One tenant's data is invisible to another.
!Today A lone agent leans on application code to remember not to show the wrong person the wrong data.
the cell Row-level securityA rule the database engine enforces itself on every read and write: it filters which rows each person can see, and refuses writes to rows they are not allowed to touch, so the application never has to get the filtering right. filters rows inside the engine, keyed to who is asking. Another tenantA separate, walled-off customer account whose data no other tenant can see.’s row is not forbidden, it simply does not exist for you.
A human approves the risky ones.
!Today A lone agent acts first and hopes someone reviews the log afterward.
the cell Risky actions, like a schema or a grant change, are held at an approval gate until a human says yes. The work waits; it does not proceed on its own.
Every action lands in the flight recorder.
!Today A lone agent's actions vanish into a chat log nobody can query.
the cell Every action is written to an append-only audit logA permanent, add-only record of every action, which can be read but never edited or deleted, so the history always holds., permanent and queryable, so you can always prove exactly what happened and when.
from our own systems
The defense, enforcing today
These are not policies in a document. They are constraints in the running database: values that cannot be malformed, rows one tenantA separate, walled-off customer account whose data no other tenant can see. cannot see, changes a human must approve, and an audit logA permanent, add-only record of every action, which can be read but never edited or deleted, so the history always holds. that only ever grows.
7,098
442
108
342,762
zoom in
Down to a single rejected write
One action, proposed by a cell, checked against the typed contract, and refused with a specific Postgres error before it ever touched the record. That is the immune response. Not a warning, a refusal.
Curious how a layer like this would fit your own records?