Keys everywhere
Teams paste provider API keys into apps, scripts and agents. Nobody can say who is using which model, or for what.
Coming soon on AWS Marketplace
Govern every AI request,
from one place.
Control Warden is an identity-aware gateway for AI. Every prompt from your people and agents is checked against who they are and what they're allowed to do, before it reaches any model. It runs in your AWS account, so your data never leaves your VPC.
- Works with any model
- OpenAI-compatible API
- Deploys with CloudFormation or Helm
AI is already in every team.
The rules usually aren't.
Agents with too much access
An agent acting for an intern shouldn't get the CFO's models and data. Today most agents run with whatever key they were given.
No record of what was sent
When customer data or a secret ends up in a prompt, there's no audit trail, and nothing stopped it on the way out.
How it works
One gateway between your organisation and every model.
Apps and agents send requests to Control Warden instead of directly to a provider. The gateway works out who is asking, applies your rules, redacts what shouldn't leave, and only then forwards the request.
- 1
Connect your models
OpenAI, Anthropic, Amazon Bedrock, Google Vertex AI, Azure OpenAI, OpenRouter, Ollama and other local models. Agent platforms too: Snowflake Cortex Agents and Bedrock Agents.
- 2
Say who can use what
Write rules in plain English, like "Engineers can use external models" or "Never send secrets to a model". Control Warden turns them into policy and tests every change before it goes live.
- 3
Point your apps at the gateway
It speaks the OpenAI API, so most tools only need a new base URL and key. Agents acting for a person add one header, and they never get more access than that person has.
Product
Built for the people who answer for AI.
Security, platform and governance teams get one place to decide, test, and prove how AI is used.
Policies anyone can read
Allow or block by person, role, department, agent and model, with conditions like "only internal models" or "no restricted data". Each rule reads as a sentence, and exact Cedar policy sits underneath for auditors.
- Default deny. Block rules always win.
- Observe mode to see the impact before you enforce.
- Every change versioned and signed.
Agents never outrank their people
When an agent acts for someone, it gets only what both are allowed: the agent's access and the person's access, never more. The access matrix shows exactly who and what can reach each model.
- Separate identities and keys for every agent.
- Agents have owners who are accountable for them.
- Conversations are tied to the right caller.
Tests before every change
Write the outcomes you expect, like "HR can't use external models" or "SSNs never leave". Control Warden runs the suite on every policy change and stops any change that would break one.
- Try any request in the policy tester first.
- Starter tests included.
- Clear reasons when something is blocked.
Every request, on your terms
See who asked what, which rule decided, what was redacted and how the model answered. Prompt and response content stays on gateways in your VPC, and your browser reads it from there directly. The control plane only ever sees metadata.
- Secrets and personal data redacted before they leave.
- Search by caller, model, decision or rule.
- Full audit trail for compliance reviews.
Data protection
Finds secrets, keys, SSNs, card numbers and more in prompts, then blocks or redacts them before they reach external models.
Single sign-on
Admins sign in with Okta, Entra ID, Google, Cognito or any OIDC or SAML provider, with admin and read-only roles.
Any model, one API
Frontier, cloud and local models behind a single OpenAI-compatible endpoint, with streaming.
Signed configuration
Gateways only accept policy bundles signed by your control plane, and keep enforcing the last good one if it's unreachable.
Live overview
Requests, blocks, redactions and the rules doing the work, across every gateway, in one dashboard.
Built-in assistant
Ask questions about what you're looking at, in plain English, using any model you choose, including local ones.
OpenAIAnthropicAmazon BedrockBedrock AgentsGoogle Vertex AIAzure OpenAISnowflake Cortex AgentsOpenRouterMistralGroqTogether AIDatabricksHugging FaceOllamaMLXvLLMAny OpenAI-compatible API
Tour
See it in three minutes.
Security & deployment
Your VPC. Your keys. Your data.
- Self-hosted in your AWS account. Deploy with CloudFormation on Amazon ECS, or with Helm on Amazon EKS. Everything runs on private subnets behind an internal load balancer.
- Prompts never leave your network. Content is stored on your gateways. Only counts and decisions are used for dashboards and billing.
- No long-lived AWS keys. Uses IAM task roles and IAM roles for service accounts. Generated secrets live in AWS Secrets Manager.
- Hardened images. Minimal distroless containers that run as non-root, scanned on every release.
- Fails safe. Default deny. If the control plane goes down, gateways keep enforcing the last signed policy.
Point any OpenAI client at Control Warden
# Before: straight to the provider
client = OpenAI(api_key="sk-...")
# After: through Control Warden
client = OpenAI(
base_url="https://warden.acme.internal:8000/v1",
api_key=os.environ["CONTROLWARDEN_KEY"],
default_headers={
# optional: agent acting for a person
"X-ControlWarden-On-Behalf-Of": "alice",
},
)Pricing
Simple usage pricing on your AWS bill.
Buy through AWS Marketplace. There's no separate contract or invoice, and it can count toward your AWS commitment.
Usage
$10per identity / month
Billed hourly for each enabled person and agent.
- Plus $0.20 per 1,000 governed requests
- Unlimited gateways and models
- Single sign-on included
- Cancel any time
Enterprise
Customannual contract
A private offer through AWS Marketplace, with committed-use pricing.
- Volume pricing for identities and requests
- Deployment and policy design help
- Priority support
FAQ
Questions, answered.
Does any of our data leave our AWS account?
No. Prompts and responses stay on gateways in your VPC. Control Warden reports only usage counts to AWS Marketplace for billing.
Which models and tools work with it?
Anything that speaks the OpenAI API works without code changes. Control Warden also translates to Anthropic, Amazon Bedrock, Google Vertex AI, Snowflake Cortex Agents and Bedrock Agents, and works with local models through Ollama, MLX or vLLM.
How do AI agents get access?
Each agent gets its own identity, key, roles and an accountable owner. When it acts for a person, it sends that person's ID, and the request is allowed only if both the agent and the person are allowed.
Will it slow requests down?
Policy is evaluated locally on the gateway, which typically adds a few milliseconds. Responses stream straight through.
What happens if the control plane is down?
Gateways keep enforcing the last signed policy they received, and keep recording activity. Nothing fails open.
Can we try it before rolling it out?
Yes. Start in observe mode, which records what would have been blocked without blocking anything. Switch to enforce when you're ready.
Put a warden on your AI.
Join the early access list and we'll help you deploy Control Warden in your own AWS account.