Ordinance · Policy enforcement for AI agents
Let your AI agents act — inside your policy, with the evidence to prove it.
Ordinance checks every AI and human action against your written policy before it runs — and logs the decision to the exact NIST 800-171 / CMMC control. Adopt agents and copilots without breaking CMMC, NIST 800-171, or SOC 2.
"A policy checkpoint for AI agents that speaks compliance."
One question, before every sensitive action
Before an agent exports data, creates an account, or calls a tool, it asks Ordinance. Ordinance checks your policy and returns one of three answers — and records why, against the control it satisfies.
The action proceeds — and still records the control it just evidenced.
The action is refused, with the plain-language reason and the failing rule.
A missing fact or a risky target routes to a human approval gate — silence never buys a yes.
# the agent asks before exporting CUI
POST /v1/evaluate
{
"action": "data.export_cui",
"context": { "dlp_scan_passed": false }
}
# Ordinance answers — with the control
{
"decision": "deny",
"controls": ["NIST 800-171 3.1.3", "CMMC L2 AC.L2-3.1.3"],
"reasons": ["DATA-001: requires 'dlp_scan_passed'…"]
}Why Ordinance, and not a general-purpose "AI guardrail"
Most guardrails ask an AI to judge your policy — non-deterministic, and your sensitive data goes to someone else's model. Ordinance is built for regulated environments, where "the agent did something it shouldn't have" is a finding, not a bug.
Rules, not a second AI
Decisions are exact policy checks — the same input always yields the same answer, with no LLM in the decision path to be prompt-injected or to drift. Repeatable and explainable, the way an assessor wants.
Nothing leaves the box
Self-hosted, one container, offline-licensed — no telemetry, no external calls in the decision path. Your CUI-bearing context is evaluated locally and never shipped to a cloud model.
Evidence on every decision
ALLOW, DENY, and ESCALATE alike are logged against the exact control they satisfy. Export the decision log and control-coverage matrix an assessor asks for — your evidence writes itself.
Speaks your frameworks
Every rule cites the controls it enforces, so policy and evidence stay in one place. Purpose-built for the CMMC / CUI world, and useful anywhere audit trails matter.
Straight about how it enforces
Ordinance is an advisory decision layer by design — and we'd rather tell you exactly what that means than let you find out later.
- Ordinance decides; your integration enforces by honoring the verdict. We ship a one-line enforcement client (
enforce()/@guard) and an agent tool-gating example so an agent only runs what policy permits. - It evaluates the context you give it — so decision-critical facts should come from trusted systems (your IdP, your DLP), not the agent's self-report. Our Safe-Use Framework walks you through it.
- For a hostile agent, deploy Ordinance as the policy brain behind your containment boundary — it makes honest agents provably compliant and gives your controls their decision-and-evidence layer.
Don't take our word for it — run the proof.
A reproducible battery shows Ordinance's ALLOW / DENY / ESCALATE decisions, its determinism, and that nothing leaves the box. Every row is generated by running the product, not asserted.
Pairs with Attestor
Ordinance is the in-the-moment gate and decision ledger. When you need cryptographically signed, long-term evidence bundles for an assessment, Attestor — our CMMC-focused SIEM — is where that heavier evidence story lives. Use them together for decision-time enforcement plus assessment-grade proof.
Give your agents capability — not a compliance incident.
See Ordinance decide against your own policies. A 20-minute call, or grab the self-hosted evaluation build and run the proof yourself.
Book a call