Dashboard and Control Tower
The Dashboard is the executive view for any period. The Control Tower maps the estate end to end and leads with what needs a person.
Free & open sourceApache 2.0
Reference implementation
AI Control Tower
Every model, agent and tool call in your enterprise, under one control plane. AI Control Tower keeps a live register of every provider, model, agent, application and MCP server, and watches every run as it happens. Put it in the request path and governance stops being advice: policies refuse, budgets stop, routing and tool access are enforced on live traffic, and your applications never hold an upstream credential.
- 3
- gateways in the request path: AI, MCP and agent-to-agent
- 17
- modules, from registries to compliance evidence
- G1 · G3 · G4
- IRGF gates recorded as decisions with separation of duties
- 3
- regimes mapped: EU AI Act, ISO/IEC 42001, NIST AI RMF
How it runs
Two modes, side by side
You do not have to re-plumb the estate on day one. Engines can report what they did and be observed; the systems that need hard controls can move into the request path one at a time.
Reporting mode
Your engines keep calling their providers directly and report what they did to the telemetry API. The Tower observes and advises; it is never in the request path.
Gateway mode
Applications send model calls to the AI Gateway, tool calls to the MCP Gateway and work for other agents to the A2A Gateway. Policy verdicts become real refusals, budgets become real stops, and every call is recorded.
Built on IRGF
Where the framework becomes working logic
The stages, gates, tiers and modules described in the implementation documentation are not labels in the Control Tower. They decide which policies apply, who may sign, and how fast drift has to be answered.
| IRGF | In the Control Tower |
|---|---|
| S0–S1 · G1Use-case intake | An AI idea is recorded before anything is built: the need, the non-AI alternative, the decision it supports, who it affects, its autonomy and data path, and provisional D1–D5 scores. Gate G1 is decided by the people its tier calls for, with IRGF’s five outcomes, and an approved use case becomes a draft application. |
| S2Risk classification | Every agent and application is scored on the five dimensions and given a tier from 1 to 4, which someone outside the delivery line countersigns. |
| G3Deployment authorization | An agent or application is authorized as one configuration, at one tier, for one owner. An application is authorized with its composite authority: everything its agents can reach between them. |
| G4Change control | Every edit to what was authorized is caught and routed by IRGF’s change table, including new agent-to-agent contracts. |
| M12Control Plane | What every agent and application actually does is compared with what Gate G3 authorized. Action limits are enforced before each tool call and every action is verified after it. |
| M13Drift | Each divergence becomes a drift record with a response window set by its category and tier. |
| M17Exceptions | One policy can be set aside for one system for at most ninety days. |
| SoDSeparation of duties | From Tier 3, nobody signs a gate decision for a system they own or a request they made. Tier 4 takes two different people, and service accounts never sign. |
| Links 06–07Agent runtime | A Tier 3–4 agent answers only to service accounts bound to it. Anyone on call can pull its kill-switch; only a person can release it. |
Product tour
Every module, from the seeded demo organization
Screenshots are from a seeded demo organization. Select any screenshot to open it full size; use the arrow keys to move through a module.
Onboarding
A hub walks the estate in dependency order: providers, models, agents and applications; routing and MCP servers; policies, rules, budgets and risks; then IRGF classification and authorization. Each step shows what it still needs. Every save is permission-checked and audited, and editing a system authorized at Gate G3 goes through change control.
AI Landscape: the registries
Every AI asset with its owner, environment, criticality, risk and status. An agent’s page shows its execution chain, the tools and knowledge sources it may use, and its IRGF record: risk tier, deployment authorization, Control Plane findings, the eight-link governance chain, its Agent Card and the kill-switch.
Observability
Every run reported by an engine or served by a gateway, with a normalized timeline of prompts, model calls, tool calls, approvals and policy violations, plus tokens, duration and cost. The Live Monitor streams runs in flight over WebSockets.
AI Gateway
What the gateway is doing to live traffic: requests, fallbacks, latency, spend, provider circuit breakers and routing outcomes. The Routing Simulator shows which models the platform would choose right now, in what order, and why the others were excluded.
MCP Gateway
Every MCP server in one registry, reached through one governed endpoint. New tools, and tools whose definition changed after approval, wait for review. Servers are restricted to granted agents, and every brokered call is logged, including the refused ones with their reason.
A2A Gateway
Agent-to-agent work under the same rules as model and tool calls, over the Agent2Agent protocol. Agents and their skills are reviewed before anyone may ask for them; contracts say which agent may hand work to which, with what data ceiling and rate; chains stop at a hop limit and never loop back.
AI FinOps
Spend today, this week and this month with a projection. A drill-down Cost Explorer from department to team, agent, model and provider; GitHub Copilot seat and premium-request spend; budgets that warn when spend is forecast to pass the limit; and costed optimization recommendations.
Use-Case Intake and Gate G1
An AI idea is recorded before anything is built, scored provisionally on D1–D5, decided at Gate G1 by the people its tier calls for, and registered as a draft application once approved.
IRGF lifecycle
Risk classification at S2, deployment authorizations at G3 with Tier 4 taking two signatures, changes caught at G4, time-boxed exceptions under M17, and the Control Plane turning every divergence from what was authorized into a drift record with a response window.
AI Governance
A risk register with a five-by-five heat map, an Approval Centre for actions waiting on a human, typed policies that deny, require approval or warn in every gateway, and an Evaluation Centre that runs scored suites and red-team cases before a model may serve.
Compliance and Evidence
Each system’s obligations under the EU AI Act, ISO/IEC 42001 and the NIST AI RMF, answered from what the platform already records, with scope decisions, attestations for what it cannot see, and an evidence pack to print or download for an auditor.
AI Studio: Solution Advisor and AI Sandbox
Describe a use case in plain terms and get a blueprint: approach and alternatives, stack, a build plan mapped to IRGF stages and gates, team, risks, cost and the controls its tier calls for, proposed at Gate G1 in one click. The Sandbox compares prompts across up to three models through the gateway, so policies and budgets apply.
IRGF Agent
A chat icon on every page answers questions about the framework (stages, gates, tiers, modules, the agent chain) and how the Control Tower applies it, from the framework reference and the rules the platform enforces, with links to the sources.
Control and Settings
Users, teams and service accounts with API keys shown once. An append-only audit trail where every entry carries a content hash, so a change made directly in the database is still detectable. Each person chooses which alerts reach them.
Integration Handbook
The developer guide built into the platform: onboarding, the API reference, the gateways, sample code for Python, TypeScript and common agent frameworks, the security model and troubleshooting.
Using the gateways
One secret per application, everything else governed
An application holds exactly one secret: its service-account key. Calls go from your backend, never a browser, and the platform injects the upstream credentials itself.
A governed model call
curl -X POST http://localhost:8000/api/v1/gateway/chat/ \
-H "X-API-Key: $CONTROL_TOWER_KEY" \
-H "Content-Type: application/json" \
-d '{
"agent": "customer-support-agent",
"messages": [{"role": "user",
"content": "Summarise the open incidents."}],
"max_tokens": 400
}'The response carries the answer, the model and provider that served it, token usage, cost,
every attempt made and the execution it was recorded as. Add "stream": true for server-sent events.
Every governed tool through one MCP endpoint
# Claude Code
claude mcp add --transport http control-tower \
http://localhost:8000/api/v1/mcp/customer-support-agent/ \
--header "Authorization: Bearer $CONTROL_TOWER_KEY"Any MCP client that speaks Streamable HTTP sees every tool the agent is permitted, from every
approved server, named <server>__<tool>.
The status code tells you what to do
- 202A person must approve first
- 402Budget exhausted
- 403Refused by policy; do not retry
- 503No eligible model
- 502Every attempt failed; retry with backoff
Security model
Controls that hold even when someone goes around the UI
The security model is designed so that the governance record is still trustworthy when an application, an agent or an administrator behaves badly.
No credentials in the database
Providers and MCP servers store only the name of an environment variable. In gateway mode the platform injects the secret, so applications and agents never hold upstream credentials.
Hashed, expiring API keys
Only a SHA-256 hash of each key is stored and the raw key is shown once. Keys can expire and be revoked, and the last-used time shows which are still live.
Tenant isolation
Enforced in the data layer: organization-owned records are always queried through an organization-scoped manager, and role-based access is checked on every page, action and API call.
Tamper-evident audit
Audit entries are append-only and hashed at write time; a verification command detects tampering made directly against the database.
Reviewed tools and skills
New or changed MCP tools and A2A skills wait for review. Messages between agents are held to their contract’s data ceiling, with personal data raising what they carry.
Prompt content is a privilege
Viewing prompts is a separate permission, and content from confidential or restricted agents is redacted on shared screens.
Free and open source
Yours to run, inspect and extend
AI Control Tower is free, open-source software distributed under the Apache License 2.0. There is no licence fee, no usage tier and no feature held back: the whole platform, every gateway and the full IRGF lifecycle are in the open.
Free
No licence fees and no per-seat, per-model or per-call charges. Run it on your own infrastructure for as many systems as you govern.
Open source
The full source is open, so your security and risk teams can read exactly what the gateways enforce and how evidence is recorded, rather than trusting a description of it.
Apache License 2.0
Use it commercially, modify it and distribute it, with an express patent grant from contributors. Keep the licence and notices with any copy, and mark the files you change.
Installation and setup support
Need help getting it running?
The platform installs in minutes on a laptop, but a production setup touches your identity, your providers and your MCP servers. If you would like help with installation or setup, book a call and we will work through it with you.
- Installation and environment setup: PostgreSQL, Redis, Docker or a single machine
- Connecting your model providers, agent engines and MCP servers
- Choosing reporting or gateway mode, and moving systems into the request path
- Mapping the tiers, gates and policies to your own IRGF adoption
Contact us
Book a call on Zoom. Pick a time that suits you; no preparation needed.
Prefer email? info@irgframework.org