Controls & Monitoring
AI Agent Risk Monitor
Monitors agent actions for risky or unexpected behavior.
Controls & Monitoring
AI Access Control System
Who can reach which AI systems and data is defined by role and enforced automatically, with every grant and denial logged.
As AI tools spread, access tends to grow by habit: someone needed it once and kept it. This system ties access to roles, using the identity provider you already run. Each role gets a defined set of AI applications and data, anything outside it is denied by default, and every grant and denial is logged. You own the roles and the log.
- Role-based access to AI tools and data, denied by default
- Built on the identity provider your team already uses
- Every grant and denial logged for later questions
$5,400
20–30 working days
Optional maintenance $270/mo
What it is
AI Access Control System is an agent that manages who, whether a person or another system, can access which AI applications and data, enforcing role-based permission rules at the point of access. It governs access broadly, across people and systems, rather than one narrow slice of it.
Why businesses buy it
Loose access to AI tools is a quiet risk. A contractor keeps a login, an intern reaches confidential data through a chatbot, and nobody notices until a customer or auditor asks who could see what. Answering that from memory is slow and unconvincing. This system makes access a deliberate decision by role, with onboarding and offboarding following the same steps every time. The written scope sets how many systems and controls are covered, so you can plan with confidence.
Problems this solves
Staff and connected systems can reach AI tools they should not use
The system enforces role-based permission rules at the point of access, across up to three systems or AI applications. Each request is checked against its role, so access follows the job rather than old habits.
Nobody can say who has access to which AI application
Your access rules become up to five configured controls, shown in one admin console or written report. That gives you a single place to see who can reach what, and on what grounds.
Integrations and agents share broad keys with no clear limits
Access is governed for systems as well as people. Each connected service gets a role with defined permissions. A tool that only needs to read data cannot quietly write or export it.
Access rules are written in policy but enforced nowhere
We work from your existing policies, up to twenty documents, and turn them into rules applied when access is requested. The control test log shows each rule behaving as written.
A good fit if
More than a handful of people or systems need different levels of access to your AI applications and the data behind them.
You currently rely on shared logins or informal trust rather than defined roles for who can reach what.
You want every access grant and denial logged, so you can answer who accessed what and when if asked.
You are adding new team members, contractors or connected systems regularly and want onboarding and offboarding to follow a consistent process.
Not the right fit if
Your concern is specifically what actions your AI agents themselves may take, not human or system access broadly; see AI Agent Permission System.
You want ongoing general monitoring across your systems rather than access management; see AI Security Monitoring.
You need written access policies drafted first, before enforcing them technically; see AI Security Policy System.
You want this combined with guardrails and injection screening for your agents specifically; see AI Agent Security Layer.
How it works
- We connect to your identity provider or user directory and the AI systems in scope. This gives the control system a single place to see who exists and what they are meant to reach.
- Roles are mapped to permitted actions and data. Together we define what a given role, such as an analyst, an administrator, or a connected system, is allowed to see or do in each AI application.
- Least-privilege rules are enforced at login or session start. Access outside a role's defined permissions is denied by default rather than allowed unless explicitly blocked.
- Every grant and denial is logged. A record of who accessed what, when, and under which role is kept, so an access question can be answered from the log rather than from memory.
- New people and systems follow a consistent process. Onboarding assigns a role with its permissions already defined; offboarding removes access in the same structured way, rather than being handled ad hoc.
- A periodic access review report rounds out the picture. Alongside the live enforcement, you get a written summary of who has access to what, useful for catching roles that should be revisited.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Written authorization confirming which systems and identity source we may connect to.
- The list of AI applications and systems you want access controlled for.
- Your intended roles and what each one should be allowed to access.
- Admin access to your identity provider or user directory, as needed.
- A named IT or security owner who can approve exceptions after launch.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who can approve the role definitions and sign off the launch.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
Systems, roles and scope confirmed.
Weeks 1–2
Role definitions and enforcement rules built.
Week 3
Identity provider and system connections completed.
Weeks 3–4
Documented test scenarios run and results sent to you.
Week 4
Your review and two rounds of changes to the roles.
Go-live
Live, recorded handoff session, 30 days of support begin.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $5,400 |
| Express | 15–25 working days | $6,200 |
| Rush | 10–20 working days | $7,000 |
What you receive at handover
- AI Access Control System configured and deployed in your environment, covering up to three systems or AI applications
- Up to five access controls built from your policies, with workflow, prompt and guardrail configuration
- Connections to the agreed systems, plus an admin console or written report showing current access
- A test report with a control test log for the agreed scenarios
- An admin guide and a recorded 60-minute handoff session
- 30 days of post-launch support
Expected benefits and how to measure them
- Can make it easier to show who has access to each AI application, and why.
- Helps reduce the chance of an agent or integration reaching data it does not need.
- Gives you one place to adjust access when someone changes role or leaves.
- Denied access attempts
- Count denials in the admin console each week after launch. Review whether each one was expected or points to a rule that needs changing.
- Accounts with more access than their role needs
- Count them in an access review before launch. Repeat the review after the first month and compare.
- Time to change someone's access
- Use ticket or email timestamps for role changes. Compare the month before launch with the month after.
Before you start: List every person, service and agent that can reach each in-scope AI application today. Note how access changes are requested and how long they take.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The build price is one-time. Running the access control system costs roughly $20 to $300 a month in your own accounts, for hosting, logging and the monitoring tools it relies on day to day.
AI model usage during the build and testing is billed the same way, directly to your accounts, so you keep ownership of every provider relationship involved.
Ask about running costsCustom requirements
If you need something outside the Scope Card, such as role management across more than three systems, add a note at checkout. You get a written Change Quote, and that work only starts once you accept it. Larger or bespoke projects go through the Custom AI request form instead.
Request a custom versionKeep it running
We recommend monthly maintenance, which covers monitoring and a monthly allowance of change hours for things such as adding a new role or adjusting permissions. It starts after the 30 days of included support and can be cancelled any month.
$270/mo (5% of the build price a month, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | An identity and access platform charges per user, monthly | A security firm quotes after a scoping call | Ours is one fixed price, shown on this page before you buy |
| Scope | An identity and access platform covers your whole IT estate broadly | An agency agrees scope during the engagement | Ours is scoped to your named AI systems, up to 3 |
| Delivery | An identity and access platform still needs weeks of role design work | A security firm engagement often takes weeks to schedule | Ours has a fixed delivery time shown before you buy, with faster options |
| Logging | An identity and access platform logs access across everything it touches | An agency build depends on what was agreed | Ours logs every grant and denial for the systems in scope |
| Certification | An identity and access platform does not certify anything on its own | An agency may offer certification as a separate service | Ours sets up access controls that reduce risk; no certification is implied |
Questions about this product
What does AI Access Control System actually control?
It controls who, whether a person or a connected system, can access which of your AI applications and the data behind them, enforcing that by role at login or session start. It is a general-purpose access job covering people and systems, not one narrow user group or a single application.
How is AI Access Control System different from AI Agent Permission System?
AI Access Control System manages who, human or system, can reach which AI applications and data. AI Agent Permission System is narrower, managing what actions your AI agents themselves are allowed to take once they are already running. One is about entry; the other is about agent behavior afterward.
How much does AI Access Control System cost to run each month?
Expect roughly $20 to $300 a month in your own accounts for hosting, logging and the tools the access rules run on. Your identity provider stays on its existing plan, and we add no per-user fee. The figure grows mainly with the number of systems and access events. The one-time build price for each delivery speed sits in the price panel on this page.
Does AI Access Control System work with our existing identity provider?
It connects to the identity provider or user directory you already use, rather than requiring a separate login system. During intake we confirm which provider you use and design the role mapping around it, so people keep using the accounts and passwords they already have. This keeps onboarding simple, since nobody has to learn a second login system just for AI access.
What happens when access is denied?
A denial is logged with who was denied, what they attempted, and when, and routes to your named IT or security owner if it needs following up. The system defaults to denying anything outside a defined role rather than allowing it and asking questions after the fact. This keeps a clear, auditable trail for every access decision the system makes on your behalf.
Can I add a new role or system later?
Yes. Adding a role or adjusting existing permissions fits inside the monthly change hours that come with maintenance. Extending access control across more than the three systems in scope comes through a Change Quote, priced and agreed with you before that work starts. This keeps the cost of expanding role coverage predictable as your team and systems grow.
Who owns the role definitions and access logs once it is live?
You do. The role definitions, the enforcement rules and the access log all live in your own connected accounts and identity provider, not a separate platform we control, so you keep full ownership and visibility into access going forward. We keep no separate copy that would lock you into working with us going forward.
Know exactly who can reach your AI systems.
Order AI Access Control System and role-based access starts enforcing across your named systems, live on a fixed delivery date.
Works well with
Controls & Monitoring
AI Security Policy System
Maintains security policies and checks systems against them.
Controls & Monitoring
AI Security Monitoring
Centralizes security events from AI systems with alerting.