GaaS: Governance as a Service for AI agents.

GaaS is a governance pipeline that sits between an AI agent's intent and its execution. It enriches context, evaluates policy, deliberates risk via multi-agent panels, and produces a tamper-evident audit trail. Sub-100ms for routine actions, full multi-agent deliberation for high-stakes decisions.

Routine actions complete the full governance pipeline in under 100ms (median 24 ms, p95 36 ms, measured in production). High-risk actions that trigger multi-agent deliberation take about 40–60 seconds end to end. The governance tax is proportional to the governance need.

Plans include a monthly action allowance: Free $0 (1K actions), Developer $99 (10K), Starter $500 (50K), Growth $2,500 (500K), Enterprise $10,000+ (5M+). Beyond the allowance, each decision bills once in its highest class: routine $0.002, deliberation $0.05, escalation $0.25. Shadow and test decisions are never metered, a failed deliberation bills as routine, and the audit record is never metered. Overage billing is active as of 1 August 2026, following a full report-only cycle; your included allowance is netted out first and is never metered, and usage recorded during the report-only period was not charged retroactively.

Shadow Mode runs the GaaS governance pipeline on your real agent actions without enforcement. Actions are validated, enriched, checked against your policies, and audited — but never blocked; deliberation is skipped in shadow mode. It lets you see what governance reveals about your agents before activating enforcement. Free for 14 days, no credit card required.

GaaS provides SDKs for Python, TypeScript and Java. Framework plugins are available for LangChain, OpenAI Agents, CrewAI, Pydantic AI, Vercel AI, Microsoft Agent Framework, and MCP. The API uses REST/HTTPS with JSON payloads. A typical integration adds one governance call before each agent action.

Trust Tiers are a progressive credentialing system. Registered: SDK integrated with basic policies (GaaS token issued). Verified: 30-day compliant operation demonstrated (elevated trust tokens). Certified: independent audit with full deliberation enabled (H2Om GaaS Certified).

GaaS provides two governance directions. Outbound Governance controls what your AI agents do in the world — every action evaluated before execution. Inbound Governance controls what visiting AI agents do on your digital property — identify, gate, monitor, and audit incoming agent activity.

Every time an agent declares an intent and GaaS evaluates it through the full five-stage pipeline — intent declaration, context enrichment, policy evaluation, deliberation if needed, and verdict plus audit — returning a verdict in under 100ms, that is one governance decision. The free tier covers all of that at no cost.

Every block includes a complete reasoning chain: which policy triggered, which condition failed, and what the agent would need to change to make the action compliant. Nothing is blocked silently. Your team can review every blocked action in the dashboard.

Shadow Mode requires a short SDK integration (Python, TypeScript or Java) that routes your agent's actions through the GaaS pipeline. It typically takes an afternoon for a developer using LangChain, OpenAI Agents, CrewAI, or Pydantic AI. Shadow Mode does not enforce decisions, so there is zero operational risk while you evaluate. Switching to live enforcement is a single flag change.

Guardrails live inside your agent's context window: an agent that governs itself spends about 14,700 tokens of context on every routine governed action. They have no access to real-world context and produce no auditable record. GaaS is an external governance layer: 0 tokens in your agent's context through a framework plugin, or about 2,470 through MCP; it enriches decisions with context your agent doesn't have, and produces a tamper-evident audit trail for every decision.

An external layer that checks what your AI agents are about to do and allows, fixes, holds, or blocks it against your rules, keeping a tamper-evident record of every decision.

No. GaaS is for any operator running agents. Regulated teams get framework mappings; everyone else gets control over what their agents do.

No. GaaS sits outside the agent and needs no model changes and no cooperation from the agent to work.

GaaS evaluates every governance decision against 12 regulatory frameworks and 59 built-in policies — including EU AI Act, GDPR, HIPAA, PCI DSS, CCPA, SOX, TCPA and Florida's FTSA, NIST 800-53, FedRAMP, CMMC, NIST CSF, and FERPA. Coverage is automatic based on the action type, jurisdiction, and industry. Compliance status is queryable via API and exportable for auditor review.

Every intent declaration is scanned against 17 prompt injection signatures at Stage 1 — before any context enrichment or policy evaluation occurs. Flagged payloads are rejected immediately. At Stage 3, enriched context is re-scanned for injection patterns that only emerge after enrichment. The injection checks are Tier 1 — non-disableable. Behavioral anomaly detection and session trust decay run and enforce, and security teams receive events through signed per-organization webhooks, with a guide for Splunk, Sentinel and QRadar.