Govern AI.

Gyrai is an open-source governance layer for AI. It identifies who is using AI and how, applies your policy, and sends structured audit events to the SIEM you already run.

Every event names the person, app or agent and its owner, so your analysts and auditors work from the tools and reports they already use.

See how it works Source code opens soon

Pronounced “JY-rye”.

What happens to each request

Your apps and agents call AI models through Gyrai. Four steps run on the way, and the result is written down.

Your apps and agentsPoint them at Gyrai instead of the model provider.
Gyrai

Identify

Which person, app or agent is asking, and who sponsors it.

Inspect

Looks for sensitive data, secrets and identifiers in the prompt and the reply.

Decide

Applies your policy: allow, mask, route to a private model, or block.

Record

Writes who, what, where, which policy and the outcome as a structured event, and forwards it to your SIEM.

The modelA public service, one in your cloud tenant, or a private model.
Auditevery AI request becomes an event in your SIEM. Accountabilityevery app and agent has an owner who answers for it.

Two ways in, one record

Some AI use goes through code you control. Some does not.

In the path

Apps and agents you build

Point them at Gyrai with a new address and a key. Every request and response passes through it, so policy can act before anything leaves, and each event goes to your SIEM.

  • Each agent gets its own identity and a named sponsor.
  • Rules can mask, route or block.
Observed

Chat sites, copilots and vendor agents

You cannot redirect these. Gyrai reads what your existing tools already report, then sends it to the same SIEM.

  • Microsoft Purview and other endpoint tools
  • Network proxies
  • The vendors’ own audit logs

Either way, the events land in the SIEM you already run, so “who sent what, to which model, under which policy?” is a query, not an investigation.

Beyond the request

Governing AI also means setting the rules around it.

Agents have identities

An agent is more than a service account. It acts on its own and on behalf of people, so it needs its own identity, a human sponsor and short-lived credentials.

Settings are policy

Training use, retention, private chat, memory and sharing in vendor tools decide what happens to your data afterward. Write them down and check them.

You choose where data goes

You pick where the log lives, who holds provider keys, and which kinds of data may reach which model.

Early, and honest about it

Gyrai is a working demonstration, not a finished product.

BuiltMicrosoft 365 collector
BuiltInline AI gateway
BuiltLog-file ingestion and SIEM forwarder
BuiltPolicy decisions and evidence reports
PlannedJamf and Google collectors
PlannedIdentity-provider tokens, tool proxy and approvals

Open source, Apache-2.0

The code opens soon under the Apache License 2.0, so you can run it, change it and build on it. Want to hear when it does, or try it early? Write to us.

Apache License 2.0